Submission Details
Severity:
User is `NICE` by default
Summary
By default enum value in Solidity will be equal to the first element. In our case the first element is NICE. This opens the opportunity for vulnerability.
Vulnerability Details
All users will be able to collect presents, because by default their status will be NICE.
Tools Used
Manual Review, Foundry
Proof of Concept
Added the following test case:
function testUserIsNiceByDefault() public {
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
vm.startPrank(user);
santasList.collectPresent();
assertEq(santasList.balanceOf(user), 1);
vm.stopPrank();
}
Test passes:
[PASS] testUserIsNiceByDefault() (gas: 87431)
Recommendations
Make the first element of the enum Status to NAUGHTY or NOT_CHECKED_TWICE, for example
enum Status {
NAUGHTY,
NICE,
EXTRA_NICE,
NOT_CHECKED_TWICE
}
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
default status is nice
In Solidity the first element of an enum is the default value. In Santa's List, the means each person is mapped by default to 'NICE'.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.