First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`SantasList::checkList()` lacks `onlySanta()` modifier

0xloscar01

Summary

SantasList::checkList() function lacks the onlySanta() modifier, allowing anyone to change the status of any person.

Vulnerability Details

SantasList::checkList() function is intended to be called only by the address stored at i_santa but its lacking access control.

Impact

A malicious user can prevent a person from receiving a gift by calling checkList() and setting the victim status to NAUGHTY

Tools Used

Manual review

Recommendations

Add onlySanta() modifier to the checkList() function

- function checkList(address person, Status status) external {
+ function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!