Root + Impact

The logic enforces strict equality between the two checklist states, meaning any mismatch is treated as invalid. As a result, addresses that are marked NICE in one check and EXTRA_NICE in the other cannot collect presents, even though both classifications are valid. This creates a denial of service for eligible users, undermines fairness, and introduces transparency issues since the rules promise inclusion but the implementation excludes users when checklist results conflict.

Description

The contract requires both s_theListCheckedOnce and s_theListCheckedTwice to agree before allowing minting. When one marks an address as NICE and the other marks it as EXTRA_NICE, the function reverts. This design assumes consistency between the two checks without handling disagreement, so legitimate users with differing results are blocked entirely.

Risk

Likelihood:

• Mismatched states are realistic since checklist updates may be asynchronous or subject to human error. Any address caught between NICE and EXTRA_NICE classifications will be blocked

Impact:

• Makes the first check effectively final

Breaks the expected flexibility of the “checked twice” process

• Legitimate users are denied access to presents despite being marked eligible in at least one checklist. This reduces trust in the system.

Proof of Concept

1. Mark an address as NICE in s_theListCheckedOnce.

2. Mark the same address as EXTRA_NICE in s_theListCheckedTwice.

3. Call collectPresent() from that address.

4. Transaction reverts due to mismatch, blocking minting.

Recommended Mitigation

• Adjust the logic so mismatched states are handled instead of reverting. example: Default to the stricter classification (treat NICE/EXTRA_NICE mismatch as NICE only).