Santa's List

Description

• collectPresent requires that an address has been explicitly approved by Santa with NICE or EXTRA_NICE status in both
  the once-checked and twice-checked mappings before an NFT is minted to them.

• The Status enum places NICE at index 0, which is also the default value for all uninitialized mapping(address =>
  Status) entries in Solidity. Both s_theListCheckedOnce and s_theListCheckedTwice therefore return Status.NICE for every
  address Santa has never touched, causing collectPresent's NICE branch to pass for any fresh address with no Santa
  interaction whatsoever.

enum Status {
NICE, // @> index 0 — this is the Solidity default for uninitialized mapping values
EXTRA_NICE,
NAUGHTY,
NOT_CHECKED_TWICE // @> index 3 — intended default, but never actually the default in storage
}

function collectPresent() external {
if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {
revert SantasList__NotChristmasYet();
}
if (balanceOf(msg.sender) > 0) {
revert SantasList__AlreadyCollected();
}
// @> Both mappings return Status.NICE (0) for any unchecked address
// @> This condition is TRUE for every address Santa never interacted with
if (s_theListCheckedOnce[msg.sender] == Status.NICE
&& s_theListCheckedTwice[msg.sender] == Status.NICE)
{
_mintAndIncrement();
return;
}
revert SantasList__NotNice();
}

Risk

Likelihood:

• Every Ethereum address that has never been checked by Santa satisfies the condition — the attack requires no setup, no
  prior transaction, and no Santa interaction

• The exploit is available to the entire address space after CHRISTMAS_2023_BLOCK_TIME, which is already in the past on
  any live deployment

Impact:

• The entire scarcity model of the NFT is destroyed — unlimited unique addresses can each claim one free NFT with no
  authorization

• Protocol NFT value and collector trust are nullified as any wallet can mint on demand

Proof of Concept

function testAnyoneCanCollectByDefault() public {
address randomUser = makeAddr("randomUser");
// Santa never called checkList or checkTwice for randomUser

  vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);                                                                
                                                                                                                      
  // randomUser collects with no Santa approval                                                                       
  vm.prank(randomUser);                                 
  santasList.collectPresent();

  assertEq(santasList.balanceOf(randomUser), 1);                                                                      

}

Recommended Mitigation

Reorder the enum so NOT_CHECKED_TWICE is at index 0, making it the Solidity storage default. Update all comparisons
accordingly.

enum Status {                                           

• NICE,
  

• EXTRA_NICE,                                                                                                       
  

• NAUGHTY,
  

• NOT_CHECKED_TWICE                                                                                                 
  

• NOT_CHECKED_TWICE,  // index 0 — safe uninitialized default
  

• NICE,                                                                                                             
  

• EXTRA_NICE,
  

• NAUGHTY                                                                                                           
  

  }