Summary

checkList() ought to be callable by onlySanta but is missing the access modifier and hence can be called by anyone.

Vulnerability Details

If Santa has marked a person as Status X, anyone can re-mark the person as Status Y, effectively bypassing the first check by Santa. In such a case, a griefer can make sure that checkTwice() will never be passed by that person, as the griefer will always front-run checkTwice and make sure checklist() is set to something other than NICE or EXTRA_NICE.

The person can use it himself too, to mark himself as passing the first check even when Santa has failed him.

The attacker can also front-run another user's call to collectPresent() and change user's status s_theListCheckedOnce[user] by calling checkList(), thus making the user ineligible to collect their present.

Impact

checkList() access control bypassed.

Tools Used

Manual inspection.

Recommendations

Add the onlySanta modifier to checkList().