First Flight #5: Santa's List

Summary

Incorrect Calculations in buyPresent function, the contract will be burn 1e18 and not 2e18.

Vulnerability Details

This vulnerability leads to users buy NFTS at a cheaper price because in the
function burn(address from) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
_burn(from, 1e18);
}
It automatically burns 1e18 and not 2e18 without taking into consideration PURCHASED_PRESENT_COST variable

Impact

High

Tools Used

Manual Analysis

Recommendations

In the burn function we need to change this line _burn(from, 1e18)
to _burn(from, 2e18); we can delete the PURCHASED_PRESENT_COST because this value is hard coded in the contract