Initial status value is NICE
Summary
In the s_theListCheckedOnce and s_theListCheckedTwice mappings the naughtyOrNice property defaults to 0 which means everyone is NICE by default.
Vulnerability Details
When the list is not checked by Santa yet, any address could call the collectPresent function and mint an ERC721 because the Status has been set to NICE by default
Impact
Exploiting this vulnerability any address could mint a token without being checked, an attacker could create an unlimited amount of addresses and send them to another address and sell them on secondary markets and dump the price while the nice children would only get 1 token.
Tools Used
vscode
Recommendations
Change the first item of the enum to UNDEFINED, NAUGHTY, NOT_CHECKED_TWICE or anything other than NICE or VERY_NICE
Lead Judging Commences
default status is nice
In Solidity the first element of an enum is the default value. In Santa's List, the means each person is mapped by default to 'NICE'.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.