Addresses eligible for present can collect present for more than one
Summary
Addresses eligible for present can collect present for more than one
Vulnerability Details
The comment mentions that addresses should not be able to collect present more than once, it does this by checking the nft balance of the address. Attacker can bypass this check by transfering their nft to another address owned by them to make their balance to 0 and collect more than once
Impact
Attacker can collect present more than once
Tools Used
Manual review
Recommendations
Instead of checking the balance, create a mapping that track if an address has collected their present
Lead Judging Commences
Weak Already Collected Check
Relying on balanceOf > 0 in collectPresent() allows the msg.sender to send their present to another address and then collect again.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.