Santa's List
AI First Flight #3
Beginner FriendlyFoundry
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Add onlySanta modifier to checkList function.

bsvoboda

Missing access control on checkList allows anyone to check the list first.

The protocol assumes that Santa is interacting with the checkList function. However, there is no limitation and anyone can run this function to check the list.

function checkList(address person, Status status) external @> {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}

Risk

Likelihood: High

Impact: Medium

Proof of Concept

First, nobody is checked once. However, anyone call call the checkOnce function with any address or status, regardless if they are Santa or not.
​
Then, each person that got called with this checkOnce function will be on the checkOnce list.

Recommended Mitigation

- function checkList(address person, Status status) external {
+ function checkList(address person, Status status) external onlySanta {
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!