First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Wrong present price set

Martin7777

Summary

Wrong price set for buying presents using 'buyPresent' function.

Vulnerability Details

function burn(address from) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
@> _burn(from, 1e18);
}

Acording to contest details buying ERC721 token using Santa ERC20 token should cost 2e18. After SantaList contract calls burn function in SantaTokencontract only 1e18 is burned.

Impact

Users mints ERC721 tokens for half of the price.

Tools Used

  • foundry

Recommendations

Change amount input in '_burn' function call to 2e18.

- _burn(from, 1e18);
+ _burn(from, 2e18);
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Price is not enforced in buyPresent

This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.