Anyone can mint NFT through collectPresent()
Summary
Only those who have had their status changed to NICE (or EXTRA_NICE) by Santa should be able to mint NFTs, but due to the default value of Status, anyone can mint it.
Vulnerability Details
In the enum, the value defined at the top is set to NICE. solidity's specification makes this the initial value, so s_theListCheckedOnce[msg.sender] == Status.NICE && s_theListCheckedTwice[msg. sender] == Status.NICE validation will pass anyone.
Impact
Anyone can mint NFT that should be unmintable.
Tools Used
Manual
Recommendations
The top definition of enum should be NAUGHTY or NONE, etc.
Lead Judging Commences
default status is nice
In Solidity the first element of an enum is the default value. In Santa's List, the means each person is mapped by default to 'NICE'.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.