Santa's List

Description

• The protocol declares PURCHASED_PRESENT_COST = 2e18 as the cost in SantaTokens for calling buyPresent, and EXTRA_NICE
  users receive SantaTokens as their reward for being on the nice list.

• PURCHASED_PRESENT_COST is never referenced in any executable code path. SantaToken.burn hardcodes 1e18 regardless of
  the constant, meaning the actual cost is 1 token (not 2), the constant is dead code, and the protocol's own
  documentation contradicts its on-chain behavior. EXTRA_NICE users receive exactly 1e18 from mint — enough for one
  purchase — but only because the burn also happens to be 1e18, not because the constant is used.

// SantasList.sol
// @> Declared as 2e18 but referenced nowhere in logic
uint256 public constant PURCHASED_PRESENT_COST = 2e18;

function buyPresent(address presentReceiver) external {
// @> No reference to PURCHASED_PRESENT_COST anywhere in this function
i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}

// SantaToken.sol
function burn(address from) external {
if (msg.sender != i_santasList) revert SantaToken__NotSantasList();
// @> Hardcoded 1e18 — half of PURCHASED_PRESENT_COST, never reads the constant
_burn(from, 1e18);
}

function mint(address to) external {
if (msg.sender != i_santasList) revert SantaToken__NotSantasList();
// @> Also hardcoded 1e18 — if cost were corrected to 2e18 without updating mint,
// @> EXTRA_NICE users would never have enough tokens to buy a present
_mint(to, 1e18);
}

Risk

Likelihood:

• Every buyPresent call burns 1e18 tokens instead of 2e18 — the discrepancy is active in 100% of calls from the moment
  of deployment

• Any front-end or integration reading PURCHASED_PRESENT_COST to display cost or set approvals will mislead users with
  the wrong amount

Impact:

• Presents cost half the intended price, inflating NFT supply beyond the protocol's economic design

• If the constant were ever enforced in an upgrade, EXTRA_NICE users would be permanently locked out of buyPresent since
  their 1e18 mint allocation would be insufficient

Proof of Concept

function testPurchasedPresentCostNeverEnforced() public {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();

  vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
  vm.prank(user);                                                                                                     
  santasList.collectPresent();                          

  // User has 1e18 — PURCHASED_PRESENT_COST says they need 2e18                                                       
  assertEq(santaToken.balanceOf(user), 1e18);
  assertEq(santasList.PURCHASED_PRESENT_COST(), 2e18);                                                                
                                                        
  // buyPresent succeeds anyway — only 1e18 is burned                                                                 
  vm.prank(user);                                       
  santasList.buyPresent(user);                                                                                        
  assertEq(santaToken.balanceOf(user), 0);              
  assertEq(santasList.balanceOf(user), 2); // second NFT at half the documented price                                 

}

Recommended Mitigation

Pass the amount through the constant and align the mint so EXTRA_NICE users receive enough for one purchase:

// SantaToken.sol

• function mint(address to) external {

• function mint(address to, uint256 amount) external {
  if (msg.sender != i_santasList) revert SantaToken__NotSantasList();

• _mint(to, 1e18);                                                                                                  
  

• _mint(to, amount);
  

  }

• function burn(address from) external {

• function burn(address from, uint256 amount) external {
  if (msg.sender != i_santasList) revert SantaToken__NotSantasList();

• _burn(from, 1e18);                                  
  

• _burn(from, amount);
  

  }

// SantasList.sol — collectPresent EXTRA_NICE branch

• i_santaToken.mint(msg.sender);

• i_santaToken.mint(msg.sender, PURCHASED_PRESENT_COST);

// SantasList.sol — buyPresent (after applying fix for finding 3)

• i_santaToken.burn(msg.sender);

• i_santaToken.burn(msg.sender, PURCHASED_PRESENT_COST);