Missing *onlySanta* Modifier
Summary
The onlySanta modifier is missing at checkList function.
Vulnerability Details
The NatSpec documentation for the checkList function indicates that the function can only be called by the santa, yet currently, there is no control structure to ensure that. Additionally, it is an external function which can be called by anyone.
Impact
Undesired individuals can access the checkList function and emit new events. Related off-chain protocols may be negatively affected by this vulnerability.
Tools Used
Manual reading
Recommendations
Implement the onlySanta modifier for the checkList function to enforce access control and ensure that only the designated santa can invoke the function.
Lead Judging Commences
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.