Unused `PURCHASED_PRESENT_COST` lead to different purchase cost
Summary
The constant StantasList::PURCHASED_PRESENT_COST sets the price of a NFT to 2e18 SantaToken. PURCHASED_PRESENT_COST is never used and in the function SantaToken:burn the burned amount is 1e18
Vulnerability Details
Impact
Stated in the constant StantasList::PURCHASED_PRESENT_COST there is a difference in 1e18 SantaToken that is not payed when buying a present.
Tools Used
-Foundry
Recommendations
Using the constant StantasList::PURCHASED_PRESENT_COST to determine the price for a NFT SantaToken:burn
Lead Judging Commences
Price is not enforced in buyPresent
This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.