The function SantasList.checkList()
does not have the onlySanta
check which allows every user to call it.
Each user can add himself to the s_theListCheckedOnce
using a call to the function SantasList.checkList()
which is unprotected.
The impact is low, because Santa checks everybody anyway and overwrites the status if there is one already.
Manual code review.
Add the onlySanta
modifier to the function SantasList.checkList()
.
And here's a test for this:
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.