Submission Details
Severity:
`buyPresent()` can be called even before Christmas
Summary & Vulnerability Details
The protocol attempts to constrain the users from having NFTs before Christmas (CHRISTMAS_2023_BLOCK_TIME). Although this check is applied correctly inside collectPresent(), it is not the case for buyPresent().
The function buyPresent() can be called by (actually for, but that's a different bug) anyone with SantaTokens to gain a NFT. This can be done even before Christmas .
function buyPresent(address presentReceiver) external {
i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}
Impact
Once can get their hands on presents (NFTs) even before Christmas arrives.
Tools Used
Manual inspection.
Recommendations
Add the check inside buyPresent() too:
function buyPresent(address presentReceiver) external {
+ if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {
+ revert SantasList__NotChristmasYet();
+ }
i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.