First Flight #5: Santa's List
First Flight #5

First Flight #5: Santa's List
Beginner FriendlyFoundry
100 EXP
View repo View results
Previous Next
Submission Details
Severity: high
Valid

`burn` in `buyPresent` function can burn any user's `SantaTokens`

0x0bserver
Updates

Lead Judging Commences

InAllHonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

buyPresent should use msg.sender

Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.

Support

FAQs

Can’t find an answer? Join our Discord or follow us on Twitter.