Santa's List
AI First Flight #3
Beginner FriendlyFoundry
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Enum Default Value Allows Claiming Presents Without Double Santa Validation

jfornells

[H] Status.NICE as Default Enum Value + Unchecked Users Can Claim collectPresent()

Description

  • Expected behavior: only users validated by Santa twice should pass the collectPresent() validation.

  • The issue: Status.NICE is the enum's 0 value. Uninitialized mappings return 0, so an unchecked user appears as NICE in both s_theListCheckedOnce and s_theListCheckedTwice.

// Root cause in the codebase with @> marks to highlight the relevant section
Lines 69 - 74
enum Status {
@> NICE, // default value = 0
EXTRA_NICE,
NAUGHTY,
NOT_CHECKED_TWICE
}
​
Lines 154 - 156
@> if (s_theListCheckedOnce[msg.sender] == Status.NICE && s_theListCheckedTwice[msg.sender] == Status.NICE) {
@> _mintAndIncrement();
@> return;
@> }

Risk

Likelihood: High

  • Any uninitialized address automatically maps to NICE in both mappings.

  • Exploitation is trivial: call collectPresent() after the Christmas time check.

Impact: High

  • Unchecked users can claim presents because mapping default values cause them to pass as NICE on both checks.

  • The same root cause also allows checkTwice to accept NICE without a real first check, breaking the integrity of Santa's double-validation process.

Proof of Concept

This test demonstrates that an unchecked address appears as NICE and can claim a present regardless.

function test_Any_User_Can_Claim_Present_Without_Check_Twice() public {
address alice = makeAddr("alice");
​
// Advance time to bypass the Christmas time restriction
vm.warp(block.timestamp + 1_703_480_381);
​
// Uninitialized enum default value = 0 => Status.NICE
assertEq(uint256(santasList.getNaughtyOrNiceTwice(alice)), uint256(SantasList.Status.NICE));
​
// Alice has never been checked by Santa, but can still claim
vm.prank(alice);
santasList.collectPresent();
​
// Proof of unauthorized minting
assertEq(santasList.balanceOf(alice), 1);
}

Recommended Mitigation

Add an explicit uninitialized state at index 0 (e.g., UNKNOWN) and require an explicitly assigned status by Santa before validating eligibility.

enum Status {
+ UNKNOWN, // default value for uninitialized mappings
NICE,
EXTRA_NICE,
NAUGHTY,
NOT_CHECKED_TWICE
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-02] All addresses are considered `NICE` by default and are able to claim a NFT through `collectPresent` function before any Santa check.

## Description `collectPresent` function is supposed to be called by users that are considered `NICE` or `EXTRA_NICE` by Santa. This means Santa is supposed to call `checkList` function to assigned a user to a status, and then call `checkTwice` function to execute a double check of the status. Currently, the enum `Status` assigns its default value (0) to `NICE`. This means that both mappings `s_theListCheckedOnce` and `s_theListCheckedTwice` consider every existent address as `NICE`. In other words, all users are by default double checked as `NICE`, and therefore eligible to call `collectPresent` function. ## Vulnerability Details The vulnerability arises due to the order of elements in the enum. If the first value is `NICE`, this means the enum value for each key in both mappings will be `NICE`, as it corresponds to `0` value. ## Impact The impact of this vulnerability is HIGH as it results in a flawed mechanism of the present distribution. Any unchecked address is currently able to call `collectPresent` function and mint an NFT. This is because this contract considers by default every address with a `NICE` status (or 0 value). ## Proof of Concept The following Foundry test will show that any user is able to call `collectPresent` function after `CHRISTMAS_2023_BLOCK_TIME` : ``` function testCollectPresentIsFlawed() external { // prank an attacker's address vm.startPrank(makeAddr("attacker")); // set block.timestamp to CHRISTMAS_2023_BLOCK_TIME vm.warp(1_703_480_381); // collect present without any check from Santa santasList.collectPresent(); vm.stopPrank(); } ``` ## Recommendations I suggest to modify `Status` enum, and use `UNKNOWN` status as the first one. This way, all users will default to `UNKNOWN` status, preventing the successful call to `collectPresent` before any check form Santa: ``` enum Status { UNKNOWN, NICE, EXTRA_NICE, NAUGHTY } ``` After modifying the enum, you can run the following test and see that `collectPresent` call will revert if Santa didn't check the address and assigned its status to `NICE` or `EXTRA_NICE` : ``` function testCollectPresentIsFlawed() external { // prank an attacker's address vm.startPrank(makeAddr("attacker")); // set block.timestamp to CHRISTMAS_2023_BLOCK_TIME vm.warp(1_703_480_381); // collect present without any check from Santa vm.expectRevert(SantasList.SantasList__NotNice.selector); santasList.collectPresent(); vm.stopPrank(); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!