First Flight #5: Santa's List

Summary

The buyPresent function is not callable by only Naughty People

Vulnerability Details

Based on the comments above the function and project documentation only Naughty people can call this function.However we dont check if a person is naughty or not upon calling this function
/*
* @notice Buy a present for someone else. This should only be callable by someone who is naughty.
* @dev You'll first need to approve the SantasList contract to spend your SantaTokens.
*/
With this vulnerability anyone can get more than 1 NFT since even NICE or EXTRA_NICE people can call this function and mint another NFT

Impact

High

Tools Used

Manual Analysis

Recommendations

Add this require statement at the beginning of the buyPresent() function
require(s_theListCheckedOnce[msg.sender] == Status.NAUGHTY)