First Flight #5: Santa's List

Summary

Anyone can call buyPresent even though they do not have santaTokens. There is mismatch between the protocol document and the implementation.

Vulnerability Details

In the documentation, it points out that the buyPresent function is only callable by anyone with SantaToken. However, there is no balance check in the function. Consider there are two users, A and B. A has santaToken and approve to the santasList contract, he/she is going to buy present for friends. B sees the chance and trigger buyPresent right before A executes the function. B can simply pass the address of A in the presentReceiver parameter and the token of A will be burnt and B will receive the NFT.

Impact

Unintended behavior for buyPresent function might lead to the loss of token for token owner.

Tools Used

Manual Review

Recommendations

1. Check whether msg.sender in buyPresnet function has enough balance.

2. burn the token of msg.sender, not the presentReceiver.

3. allocating NFT for presentReceiver, not msg.sender.