Santa's List
AI First Flight #3
Beginner FriendlyFoundry
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

H-03: checkTwice() Does Not Allow Status Changes

dxxx99217

H-03: checkTwice() Does Not Allow Status Changes

Description

  • The README states that checkTwice "changes an address to a new Status".

  • The current implementation requires the second check status to match the first check exactly, preventing any status change.

// src/SantasList.sol:137-139
function checkTwice(address person, Status status) external onlySanta {
if (s_theListCheckedOnce[person] != status) { // @> Prevents status changes
revert SantasList__SecondCheckDoesntMatchFirst();
}
s_theListCheckedTwice[person] = status;
}

Risk

Likelihood:

  • Santa attempts to upgrade or downgrade a person's status on the second check

Impact:

  • Santa cannot upgrade or downgrade a person's status on the second check

  • Users may be locked into incorrect statuses

  • Reduces flexibility in list management

Proof of Concept

function testCannotChangeStatusOnSecondCheck() public {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.NICE);
​
// Cannot change to EXTRA_NICE on second check
vm.expectRevert(SantasList.SecondCheckDoesntMatchFirst.selector);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
}

Recommended Mitigation

function checkTwice(address person, Status status) external onlySanta {
- if (s_theListCheckedOnce[person] != status) {
- revert SantasList__SecondCheckDoesntMatchFirst();
- }
+ // Allow status changes or implement proper status transition logic
+ // Remove the strict equality check
s_theListCheckedTwice[person] = status;
emit CheckedTwice(person, status);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 20 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!