Summary

Both SantasList NFT and SantaToken do not include a totalsupply. This makes it so that there is an unlimited amount that can be minted.

Vulnerability Details

Because there is no totalSupply, anyone who collects their present, can transfer the present to another user and keep minting in a continuous loop.

Impact

Flooding the supply in a DOS attack.

Tools Used

Hardhat

Recommendations

Add a TotalSupply amount to both SantasList and SantaToken. Also review the collectPresent function for reentrancy vunerablility.