First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Access Control Check in `buyPresent()`

Mj0ln1r

Summary

Buy a present for someone else feature is not working as mentioned in documentation. This should only be callable by someone who is naughty. But can be called by anyone.

Vulnerability Details

Bying present for someone else feature is intended only for the users who's Status is NAUGHTY. But there is no check for the called user Status inside the buyPresent() function.

function buyPresent(address presentReceiver) external {
i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}

No access control check was done for the user who aren't NAUGHTY.

Impact

This could cause the fail in buyPresent() intended usage. Users who aren't NAUGHTY can also able to call the buyPresent() function.

Proof Of Code :

function testBuyPresentNotNaughty() public {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santaToken.approve(address(santasList), 1e18);
santasList.collectPresent();
santasList.buyPresent(user);
assertEq(santasList.balanceOf(user), 2);
assertEq(santaToken.balanceOf(user), 0);
vm.stopPrank();
}

Add this test to the SantasListTest.t.sol and run forge test --mt testBuyPresentNotNaughty. The buyPresent() is called by a EXTRA_NICE user not a NAUGHTY user.

Tools Used

Manual Review

Recommendations

Check for the Status of the buyPresent() caller.

function buyPresent(address presentReceiver) external {
+ require(s_theListCheckedOnce[msg.sender] == Status.NAUGHTY && s_theListCheckedTwice[msg.sender] == Status.NAUGHTY);
i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.