[L-03] SantasList::buyPresent() burns payment before confirming the present mint succeeds

Description:

buyPresent() burns the payment (i_santaToken.burn(...)) before minting the present (_mintAndIncrement()). Today, Solidity's atomic revert semantics mean the burn cannot persist without the mint also succeeding within the same transaction, so there is no live fund-loss vector. This ordering is nonetheless inconsistent with defensive coding practice: should the two operations ever be split across transactions, wrapped in try/catch, or made non-atomic by a future change (e.g. a cross-chain or relayed flow), a user could have their SantaTokens burned without receiving the corresponding present.

Risk Analysis:

• Impact: Low — no live fund-loss vector today given full-transaction atomicity.

• Likelihood: Low — would only become relevant if a future change made the two operations non-atomic.

Proof of Concept:

Not demonstrable today given full-transaction atomicity; included as a defensive-coding observation to flag before any future refactor that could break atomicity.

Recommended Mitigation: