Santa's List
AI First Flight #3
Beginner FriendlyFoundry
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Missing onlySanta modifier in checkList allows anyone to poison the list

palsudhanshuxcodes

Root + Impact-Normal behavior: Only Santa should be able to call checkList to set first check status.

Description-The checkTwice function correctly has onlySanta modifier.

Issue: checkList() function at line SantasList.sol:Lxx is missing onlySanta modifier, allowing ANY external address to set s_theListCheckedOnce[person] for any person. This breaks the core invariant that Santa is the sole authority for the naughty/nice list.

This allows attacker to front-run and poison the mapping, causing Santa's subsequent checkTwice to revert if status mismatches, leading to DoS of legitimate NICE users.

// Root cause
// File: src/SantasList.sol
function checkList(address person, Status status) external {
@> s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}

​
// Step 1: Attacker poisons victim's first check
vm.prank(attacker);
santasList.checkList(victim, SantasList.Status.NAUGHTY);
// Verify victim is now NAUGHTY even though Santa didn't set it
assertEq(uint(santasList.getNaughtyOrNiceOnce(victim)), uint(SantasList.Status.NAUGHTY));
// Step 2: Santa tries to set NICE, but checkTwice will fail
vm.prank(santasList.getSanta());
santasList.checkList(victim, SantasList.Status.NICE);
vm.prank(santasList.getSanta());
vm.expectRevert();
santasList.checkTwice(victim, SantasList.Status.NICE);
// Victim DOSed, cannot collect presents
}

Risk

Likelihood:High - Likelihood: High - The function is public/external with no access control. Any EOA or contract can call it at any time with zero cost, easily front-running Santa. No privileges required.

Impact:High -Breaks core protocol functionality. Attacker can mark any victim as NAUGHTY before Santa checks. When Santa later tries to mark same victim as NICE, checkTwice will revert due to status mismatch check. This prevents NICE users from ever collecting presents (collectPresent requires NICE twice). This is permanent DoS and breaks Santa's list integrity.

Proof of Concept-The attack requires no privileges:

function test_PoC_AnyoneCanPoisonList() public {
address attacker = makeAddr("attacker");
address victim = makeAddr("victim");
// Step 1: Attacker poisons victim's first check
vm.prank(attacker);
santasList.checkList(victim, SantasList.Status.NAUGHTY);
// Verify victim is now NAUGHTY even though Santa didn't set it
assertEq(uint(santasList.getNaughtyOrNiceOnce(victim)), uint(SantasList.Status.NAUGHTY));
// Step 2: Santa tries to set NICE, but checkTwice will fail
vm.prank(santasList.getSanta());
santasList.checkList(victim, SantasList.Status.NICE);
vm.prank(santasList.getSanta());
vm.expectRevert();
santasList.checkTwice(victim, SantasList.Status.NICE);
// Victim DOSed, cannot collect presents
}

Recommended Mitigation-function checkList(address person, Status status) external onlySanta {

​
// Add onlySanta modifier
function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!