First Flight #5: Santa's List

Summary

While the comments describe the function as "Only callable by santa", this doesn't seem to case. In fact there is no access control on this function so everyone can execute the function and set the status themselves.

Vulnerability Details

Since this function is open to anyone people are able to call this function for themselves and set the state to NICE or EXTRA_NICE or call the function to set someone else's address state to NAUGHTY.

Impact

While the checkTwice function has proper access control, it could result in an error when the status is not the same as the first one, so if an attacker sets someone else's address to NAUGHTY the transaction will be reverted when Santa wants to check it twice in case the person wasn't naughty.

Tools Used

vscode

Recommendations

Add "onlySanta" modifier to the checkList function