First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Anyone can buy present at half price

Y403L

Summary

Anyone can buy present at half price.

Vulnerability Details

According to the README.md: "buyPresent: A function that trades 2e18 of SantaToken for an NFT. This function can be called by anyone."

We can know that buy present need 2e18 SantaToken, but through testing found that anyone can buy present at half price.

PoC

Only burn 1e18 of SnataToken.

function burn(address from) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
_burn(from, 1e18);
}

Working Test Case:

function testAnyoneCanBuyPresentAtHalfPrice() public {
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
// Set the user's balance to `1e18` for buy present.
deal(address(santaToken), user, 1e18);
assertEq(santasList.balanceOf(user), 0);
assertEq(santaToken.balanceOf(user), 1e18);
santaToken.approve(address(santasList), 1e18);
​
santasList.buyPresent(user);
assertEq(santasList.balanceOf(user), 1);
assertEq(santaToken.balanceOf(user), 0);
vm.stopPrank();
}

Add the test to the SantasListTest.t.sol file. Running the test with forge test --match-test testAnyoneCanBuyPresentAtHalfPrice -vvv we can see:

Compiler run successful!
​
Running 1 test for test/unit/SantasListTest.t.sol:SantasListTest
[PASS] testAnyoneCanBuyPresentAtHalfPrice() (gas: 250958)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.64ms
Ran 1 test suites: 1 tests passed, 0 failed, 0 skipped (1 total tests)

Impact

It directly leads to the loss of funds.

It's like you sell something for $100 and you only get $50.

Tools Used

Foundry

Recommendations

function burn(address from) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
- _burn(from, 1e18);
+ _burn(from, 2e18);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Price is not enforced in buyPresent

This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.