First Flight #5: Santa's List

Summary

The burn function, called within the buyPresent function, is only accessible to santa.

Vulnerability Details

The documentation specifies that the buyPresent function allows users with tokens to purchase presents for others. However, due to the burn function called within buyPresent, users other than santa encounter an authentication check that only permits santa to proceed.

Impact

Users, regardless of their token holdings, are unable to purchase presents for others.

Tools Used

Manual Reading

Recommendations

Instead of removing the control structure in the burn function, consider creating a separate buy function without an additional santa check. This modification would maintain the intended functionality of allowing users to buy presents for others without affecting the burn function's authentication check.