Santa's List
AI First Flight #3
Beginner FriendlyFoundry
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Enum Default Value Allows Unchecked Users to Appear NICE

rensley

Root + Impact

Description

  • The Status enum defines NICE as index 0, which is the default value for uninitialized enum variables in Solidity.

  • When mappings return the default value for non-existent keys, any address that was never checked by Santa will incorrectly appear as NICE status.

  • While collectPresent requires both s_theListCheckedOnce and s_theListCheckedTwice to match, this design creates a false sense of legitimacy for unchecked addresses.

// Root cause in the codebase with @> marks to highlight the relevant section
​
enum Status {
@> NICE, // index 0 - DEFAULT VALUE
EXTRA_NICE, // index 1
NAUGHTY, // index 2
NOT_CHECKED_TWICE // index 3
}

Risk

Likelihood:

  • Reason 1 // All addresses default to NICE status which is not how its intended.

  • Reason 2 // Off-chain systems querying getNaughtyOrNiceOnce() will receive misleading data

  • Reason 3 // Creates confusion in status checking logic

Impact:

  • Off-chain integrations may incorrectly assume users are verified NICE

  • Frontend displays could show incorrect status to users

  • If contract logic is modified in future upgrades, this could become exploitable

  • Auditors and developers may misunderstand the actual state of the system

Proof of Concept

Demonstrates that any random address that was never checked by Santa returns NICE status from the getter function, which could mislead off-chain monitoring systems and frontend applications.

function test_DefaultEnumIsNice() public {
address randomUser = makeAddr("unchecked");
​
// User was never checked by Santa
// But default enum value is NICE (index 0)
assertEq(
uint256(santasList.getNaughtyOrNiceOnce(randomUser)),
uint256(SantasList.Status.NICE)
);
}

Recommended Mitigation

Reorder the enum so the default value (index 0) represents an unchecked or unknown state. This ensures uninitialized mappings return a safe, accurate default.

enum Status {
+ NOT_CHECKED_TWICE, // index 0 - safe default
NICE,
EXTRA_NICE,
- NAUGHTY,
- NOT_CHECKED_TWICE
+ NAUGHTY
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 20 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-02] All addresses are considered `NICE` by default and are able to claim a NFT through `collectPresent` function before any Santa check.

## Description `collectPresent` function is supposed to be called by users that are considered `NICE` or `EXTRA_NICE` by Santa. This means Santa is supposed to call `checkList` function to assigned a user to a status, and then call `checkTwice` function to execute a double check of the status. Currently, the enum `Status` assigns its default value (0) to `NICE`. This means that both mappings `s_theListCheckedOnce` and `s_theListCheckedTwice` consider every existent address as `NICE`. In other words, all users are by default double checked as `NICE`, and therefore eligible to call `collectPresent` function. ## Vulnerability Details The vulnerability arises due to the order of elements in the enum. If the first value is `NICE`, this means the enum value for each key in both mappings will be `NICE`, as it corresponds to `0` value. ## Impact The impact of this vulnerability is HIGH as it results in a flawed mechanism of the present distribution. Any unchecked address is currently able to call `collectPresent` function and mint an NFT. This is because this contract considers by default every address with a `NICE` status (or 0 value). ## Proof of Concept The following Foundry test will show that any user is able to call `collectPresent` function after `CHRISTMAS_2023_BLOCK_TIME` : ``` function testCollectPresentIsFlawed() external { // prank an attacker's address vm.startPrank(makeAddr("attacker")); // set block.timestamp to CHRISTMAS_2023_BLOCK_TIME vm.warp(1_703_480_381); // collect present without any check from Santa santasList.collectPresent(); vm.stopPrank(); } ``` ## Recommendations I suggest to modify `Status` enum, and use `UNKNOWN` status as the first one. This way, all users will default to `UNKNOWN` status, preventing the successful call to `collectPresent` before any check form Santa: ``` enum Status { UNKNOWN, NICE, EXTRA_NICE, NAUGHTY } ``` After modifying the enum, you can run the following test and see that `collectPresent` call will revert if Santa didn't check the address and assigned its status to `NICE` or `EXTRA_NICE` : ``` function testCollectPresentIsFlawed() external { // prank an attacker's address vm.startPrank(makeAddr("attacker")); // set block.timestamp to CHRISTMAS_2023_BLOCK_TIME vm.warp(1_703_480_381); // collect present without any check from Santa vm.expectRevert(SantasList.SantasList__NotNice.selector); santasList.collectPresent(); vm.stopPrank(); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!