Summary
the function checkList can be called by any one
Vulnerability Details
the function checkList can be called by any one ,
in the comment mentions that the function can only be called by Santa
Only callable by santa , but the code itself doesn't implement any access control mechanism. You may want to add a modifier or condition to ensure that only authorized addresses (presumably Santa's address) can call this function.
Impact
Without Access Control: Anyone can call the checkList function, potentially leading to unauthorized modifications of the list.
Tools Used
Manual review , git , forge
POC
function testCheckList() public {
vm.prank(user);
santasList.checkList(user, SantasList.Status.NICE);
assertEq(uint256(santasList.getNaughtyOrNiceOnce(user)), uint256(SantasList.Status.NICE));
}
logs
Running 2 tests for test/unit/SantasListTest.t.sol:SantasListTest
[PASS] testCheckList() (gas: 16069)
Traces:
[16069] SantasListTest::testCheckList()
├─ [0] VM::prank(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D])
│ └─ ← ()
├─ [4211] SantasList::checkList(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], 0)
│ ├─ emit CheckedOnce(person: user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], status: 0)
│ └─ ← ()
├─ [690] SantasList::getNaughtyOrNiceOnce(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D]) [staticcall]
│ └─ ← 0
└─ ← ()
Recommendations
@@ -118,7 +118,7 @@ contract SantasList is ERC721, TokenUri {
* @param person The person to check
* @param status The status of the person
*/
- function checkList(address person, Status status) external {
+ function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
logs
Running 2 tests for test/unit/SantasListTest.t.sol:SantasListTest
[FAIL. Reason: Revert] testCheckList() (gas: 10957)
Traces:
[12208271] SantasListTest::setUp()
├─ [0] VM::startPrank(santa: [0x70C9C64bFC5eD9611F397B04bc9DF67eb30e0FcF])
│ └─ ← ()
├─ [12106780] → new SantasList@0xE6E33783D6533ad50d373DDaa6fD21b272a57B69
│ ├─ [711628] → new SantaToken@0x3775F01Ea2Fdf2Cf2D2422728d47CE65d7B3dc4d
│ │ └─ ← 3324 bytes of code
│ └─ ← 56503 bytes of code
├─ [302] SantasList::getSantaToken() [staticcall]
│ └─ ← SantaToken: [0x3775F01Ea2Fdf2Cf2D2422728d47CE65d7B3dc4d]
├─ [0] VM::stopPrank()
│ └─ ← ()
└─ ← ()
[10957] SantasListTest::testCheckList()
├─ [0] VM::prank(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D])
│ └─ ← ()
├─ [482] SantasList::checkList(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], 0)
│ └─ ← 0x777fe103
└─ ← 0x777fe103
