First Flight #5: Santa's List

Summary

_mintAndIncrement function uses _safeMint of ERC721 token, which leaves reentrancy attack vector.

Vulnerability Details

ERC721 token _safeMint invoke receiver's callback function, which can be used in a reentrancy attack. In this case, it can be used to mint multiple NFTs or SantaToken in collectPresent function.
For example a callback function can reenter collectPresent function to mint another NFT. (Attacker needs to transfer out minted NFT to bypass balance check)

POC

Impact

Attacker can mint muliple NFTs and SantaToken.

Tools Used

Foundry

Recommendations

(1) use _mint() function of ERC721, to avoid invoking callback
or (2) add reentrancy guard in collectPresent, buyPresent functions.