Submission Details
Severity:
Access Control: No Restriction on who can access checkList function which is against the business logic
Summary
The checkList function is expected to only be called by Santa(as stated in the @notice) but the onlySanta modifier was omitted in the function.
POC
function testCheckList() public {
-- vm.prank(santa);
++ address randomUser = address(1234);
++ vm.prank(randomUser);
santasList.checkList(user, SantasList.Status.NICE);
assertEq(uint256(santasList.getNaughtyOrNiceOnce(user)), uint256(SantasList.Status.NICE));
}
From the above, rather than pranking Santa, a random user was pranked and the test passed.
Impact
Anybody can call this function meaning that anybody can change give access to a address to receive present.
Tools Used
Manual review
Recommendations
Add the onlySanta modifier to the function.
Updates
Lead Judging Commences
inallhonesty about 2 years ago
Submission Judgement Published Assigned finding tags:
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.