Santa's List
AI First Flight #3
Beginner FriendlyFoundry
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

Missing "already collected" check in "SantasList::buyPresent" allows for an address to get multiple presents

thomasbtho

Missing "already collected" check in "SantasList::buyPresent" allows for an address to get multiple presents

Description

  • The "SantasList::buyPresent" function is intended to buy a present for someone else.

  • However, there is no check to control whether the receiver already has a present.

  • This allows anyone to mint an NFT to any receiver, regardless of whether they already have one or not.

function buyPresent(address presentReceiver) external {
@> // @audit no check here
i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}

Risk

Likelihood:

  • Whenever someone wants to buy a present to a receiver.

Impact:

  • An address could have multiple NFTs, breaking the protocol invariant of "1 NFT per address".

Proof of Concept

Add the following code to "SantasListTest.t.sol":

function testAddressCanHaveMultiplePresents() public {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santasList.collectPresent();
santasList.buyPresent(user);
assertEq(santasList.balanceOf(user), 2); // user has now 2 NFTs
assertEq(santaToken.balanceOf(user), 0);
vm.stopPrank();
}

Recommended Mitigation

Add a balance check before minting to follow CEI best practice.

function buyPresent(address presentReceiver) external {
+ if (balanceOf(msg.sender) > 0) {
+ revert SantasList__AlreadyCollected();
+ }
i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 22 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!