First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of Access Control in `checkList` Function

0xepley

Summary

The checkList function in the SantasList.sol lacks proper access control, allowing anyone to execute it. The function is intended to be callable only by Santa, but there is no modifier or check in place to enforce this restriction.

Vulnerability Details

The checkList function is designed to perform a first pass on individuals to determine if they are "naughty" or "nice." However, the absence of access control mechanisms makes it susceptible to unauthorized access. As a result, any address on the blockchain can call this function, potentially altering the status of individuals on Santa's list.

/*
* @notice Do a first pass on someone if they are naughty or nice.
* Only callable by santa
*
* @param person The person to check
* @param status The status of the person
*/
function checkList(address person, Status status) external { //@audit - This function is only callable by Santa, but there isn't any modifier to enforce this.
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}

Impact

The lack of access control in the checkList function poses a security risk as it allows malicious actors to manipulate the status of individuals, compromising the integrity of Santa's list and anyone can give the status to anyone else including himself

Tools Used

No specific tools were used to identify this issue. Manual code review and analysis were sufficient to identify the absence of access control.

Recommendations

  1. Implement a modifier or access control check to ensure that only Santa can execute the checkList function.

  2. Consider using the OpenZeppelin access control library or a similar established solution to manage roles and permissions securely.

function checkList(address person, Status status) external onlySanta{
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.