First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`SantasList::checkList()` lacks `onlySanta()` modifier

0xloscar01

Summary

SantasList::checkList() function lacks the onlySanta() modifier, allowing anyone to change the status of any person.

Vulnerability Details

SantasList::checkList() function is intended to be called only by the address stored at i_santa but its lacking access control.

Impact

A malicious user can prevent a person from receiving a gift by calling checkList() and setting the victim status to NAUGHTY

Tools Used

Manual review

Recommendations

Add onlySanta() modifier to the checkList() function

- function checkList(address person, Status status) external {
+ function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.