First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

buyPresent() not implemented according to the specification

mircha

Summary

The buyPresentfunction is burning 1e18 tokens instead of 2e18 to mint an NFT.

Vulnerability Details

In the contract description it's written that buyPresent: A function that trades 2e18 of SantaToken for an NFT. This function can be called by anyone.

But the SantaToken.burn function is burning 1e18 tokens.

Impact

Medium impact as the revenue of the contract is 50% short.

Tools Used

Manual code review.

Recommendations

The burn function should have an additional amountparameter.

function burn(address from, uint256 amount) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
_burn(from, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Price is not enforced in buyPresent

This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.