First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

checkList function is callable by anyone in SantasList.sol

TheCodingCanuck

Summary

In SantasList.sol the checkList function is missing the onlySanta function modifier.

Vulnerability Details

The external function checkList should be only callable by santa. That being said, it is missing the onlySanta modifier. Even the comments mentions that fact.

Impact

The missing modifier is bad since it enables any one to give the status they want to any address.

Tools Used

Manual review

Recommendations

Simply add the onlySanta function modifier to the function like in the following code bloc

function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.