First Flight #5: Santa's List

s_theListCheckedOnce[person] = status;

emit CheckedOnce(person, status);

}```

​

## Vulnerability Details

This external call should be only callable by Santa but, but can be called by anyone.

​

## Impact

Anyone can add an address / malicious contract and status to SantasList. They can also change the Status of previously enter address for example : NAUGHTY -> EXTRA NICE. They can also add as many address as they want as it is unrestricted.

​

## Tools Used

​

## Recommendations

​

add the "santaOnly" Modifier to this function

​

```function checkList(address person, Status status) external onlySanta {

s_theListCheckedOnce[person] = status;

emit CheckedOnce(person, status);

}```