First Flight #5: Santa's List

Summary

Users cannot claim their NFT/santa tokens

Vulnerability Details

if (balanceOf(msg.sender) > 0) { revert SantasList__AlreadyCollected(); }
The balanceOf(msg.sender) > 0) check will always fail as the user needs to have an eth balance in order to pay for gas costs. This is also not a good way to check whether a user has already claimed their presents.

Impact

Users cannot claim presents -> contract is completely broken therefore High Risk

Tools Used

manual

Recommendations

have a mapping address -> bool, that updates to TRUE when an address has claimed. Then check this value before proceeding with the present claim. This allows addresses to claim properly and stops an address claiming more than once.