Mismatch amount in `PURCHASED_PRESENT_COST` and burn amount.
Summary
The protocol documentation outline the price to buy the present is 2e18 but the buyPresent funciton only charge 1e18.
Vulnerability Details
In the protocol documentation, it states that:
The cost of santa tokens for naughty people to buy presents is 2e18.
However, in the buyPresent function it only burn 1e18 for each operation, that is, users pay less than they are required.
Impact
Protocol lose funds due to the incorrect calculation of the cost buying the gift.
Tools Used
Manual review
Recommendations
Update the unit of burning tokens to 2e18.
Lead Judging Commences
Price is not enforced in buyPresent
This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.