Submission Details
Severity:
Santa cannot mints themselves tokens
Summary
Only SantasList can call the SantaToken::mint() function rejecting any call from Santa.
Vulnerability Details
As said in the docs:
Additionally, it's OK if Santa mints themselves tokens.
Santa should be able to mint themselves tokens but there is a check at the start of the function making sure the only acceptablemsg.senderwill beSantaToken::i_santasList.
Impact
Santa can't call the SantaToken::mint() function.
Tools Used
Manual review.
Recommendations
function mint(address to) external {
if (msg.sender != i_santasList) {
+ if (msg.sender != i_santa && to != i_santa) {
+ revert SantaToken__NotSanta();
+ }
revert SantaToken__NotSantasList();
}
_mint(to, 1e18);
}
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.