Incorrect Token Burning in buyPresent Function
Summary
Incorrect Token Burning in buyPresent Function
Vulnerability Details
The buyPresent function currently invokes i_santaToken.burn(presentReceiver), leading to the unintended consequence of burning the tokens of the present receiver, rather than those of the buyer.
Impact
This misdirection results in the incorrect burning of tokens, where the recipient's tokens are depleted instead of the buyer's.
Tools Used
Foundry
Recommendations
Modify the buyPresent function to pass msg.sender as the parameter to the burn function. This adjustment will ensure that it's the buyer's tokens that are burned, aligning the action with the intended logic of the transaction.
Lead Judging Commences
buyPresent should use msg.sender
Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.