First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

the cost of the NFT via the buyPresent function is wrong - lower profit in the mint

rapstyle

Summary

Reading the documentation you understand that the cost should be 2e18 instead of 1e18: buyPresent: A function that trades 2e18 of SantaToken for an NFT. This function can be called by anyone..
But the SantaToken::burn has the wrong amount.

function burn(address from) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
@> _burn(from, 1e18);
}

Vulnerability Details

The cost of using the SantasList::buyPresent feature should be 2e18 instead of 1e18, so your profit will be halved.
In the SantasList code there is a constant PURCHASED_PRESENT_COST (which is not used) that should be used in the SantaToken contract.

Impact

The profit from the sale of NFTs through tokens will have a halved profit.

Tools Used

Manual review

Recommendations

The SantaToken::burn function needs to be modified by changing the amount of tokens to burn, using the constant SantasList::PURCHASED_PRESENT_COST that was mistakenly placed in the SantasList contract.

So, in SantasList we need to remove the constant

// This variable is ok even if it's off by 24 hours.
uint256 public constant CHRISTMAS_2023_BLOCK_TIME = 1_703_480_381;
- // The cost of santa tokens for naughty people to buy presents
- uint256 public constant PURCHASED_PRESENT_COST = 2e18;

and move it inside the SantaToken contract, after that we update the burn function

+ // The cost of santa tokens for naughty people to buy presents
+ uint256 public constant PURCHASED_PRESENT_COST = 2e18;
....
function burn(address from) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
- _burn(from, 1e18);
+ _burn(from, PURCHASED_PRESENT_COST);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Price is not enforced in buyPresent

This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.