First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can call the function `SantasList::checkList` and set the status for any address

bube

Summary

The function SantasList::checkList should be called only by Santa, but it is external and without any access control so it can be called by anyone.

Vulnerability Details

The function SantasList::checkList is not protected by the onlySanta modifier like the SantasList::checkTwice function, which means that anyone can call this function and set the status for any address. This is a critical vulnerability as it allows unauthorized manipulation of the status of an arbitrary address.

function checkList(address person, Status status) external {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}

Impact

Anyone can call the SantasList::checkList function and set the status for any address. The function testEveryoneCanCallCheckList demonstrates this vulnerability. You can add the following test function to the test file SantasListTest.t.sol and execute it with the foundry command: forge test --match-test testEveryoneCanCallCheckList

function testEveryoneCanCallCheckList() public {
// user that is not Santa
vm.prank(notSanta);
​
// set status Nice for address user
santasList.checkList(user, SantasList.Status.NICE);
assertEq(uint256(santasList.getNaughtyOrNiceOnce(user)), uint256(SantasList.Status.NICE));
}

Tools Used

VS Code, Foundry

Recommendations

Add onlySanta modifier to the SantasList::checkList function:

- function checkList(address person, Status status) external {
+ function checkList(address person, Status status) external onlySanta{
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!