First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Default value of uninitialized Status is NICE

maziXYZ

Summary

All uninitialized address in the mapping(address person => Status naughtyOrNice) private s_theListCheckedOnce; have a Status value of Status.NICE

Vulnerability Details

Solidity always provides a default value for uninitialized typed variables. uint256 (default) = 0;, bool (default) = false;, e.t.c. For enums, the first named CONSTANT acts as the initial value.

For the SantasList smart contract, calling the getNaughtyOrNiceOnce function by passing any address that has not being set in the mapping(address person => Status naughtyOrNice) private s_theListCheckedOnce; returns Status.NICE. This overrides the use of the checkList function by santa to determine if a person (address) is NICE

Impact

Santa cannot determine if an unknown address is NICE or NAUGHTY in the s_theListCheckedOnce mapping.

TEST

function testStatus() public {
SantasList.Status _userStatus = santasList.getNaughtyOrNiceOnce(user);
SantasList.Status _zeroStatus = santasList.getNaughtyOrNiceOnce(
address(0)
);
​
console.logUint(uint(_userStatus));
console.logUint(uint(_zeroStatus));
​
assertEq(uint(_userStatus), 0);
assertEq(uint(_zeroStatus), 0);
}

RESULT

[PASS] testStatus() (gas: 16654)
Logs:
0
0
​
Test result: ok. 3 passed; 0 failed; 0 skipped; finished in 3.57ms

Tools Used

  • FOUNDRY

  • Manual Review

Recommendations

Refactoring of enum Status definition so as to make a trivial constant the default value.

enum Status {
NOT_CHECKED_TWICE,
NICE,
EXTRA_NICE,
NAUGHTY,
}
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

default status is nice

In Solidity the first element of an enum is the default value. In Santa's List, the means each person is mapped by default to 'NICE'.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.