Root + Impact

In SantasList.sol, the checkList function is intended (based on developer comments) to be callable only by Santa (onlySanta). However, it completely lacks any access control modifier:

function checkList(address person, Status status) external {

s_theListCheckedOnce[person] = status;

emit CheckedOnce(person, status);

}

Because of this missing modifier, any arbitrary attacker can call checkList and overwrite the first-stage check status of any user in the system.

Description

1. Vulnerability Details:

In SantasList.sol, the checkList function is designed to record the first-stage check status of a user. However, it completely lacks any access control modifier (such as onlySanta):

Because of this missing modifier, any arbitrary external user or malicious attacker can directly call checkList and overwrite the first-stage status of any participant in the system.

Risk

High

Likelihood: High

Impact:

A malicious attacker can overwrite the first-stage check status of any legitimate user by exploiting the missing access control in checkList. This breaks the requirement in collectPresent(), causing valid transactions to revert (SantasList__NotNice()). As a result, legitimate users suffer a complete Denial of Service (DoS) and are permanently blocked from collecting their earned rewards (NFTs and SantaTokens).

Proof of Concept

Recommended Mitigation

Add the onlySanta modifier (or appropriate access control check) to the checkList function to ensure that only authorized accounts can update or modify users’ statuses in the first stage.

Ensure that critical state-modifying functions handling access control, checks, and administrative actions are strictly restricted to trusted roles.