Contest Details

Prize Pool

High - 100xp
Medium - 20xp
Low - 2xp
Starts: November 30, 2023 Noon UTC
Ends: December 07, 2023 Noon UTC

Stats

nSLOC: 116
Complexity Score: 83
About

About

Santa has adopted blockchain technology to keep track of the naughty and nice! Hooray! So Santa hired some south pole contract elves to help build him a blockchain-based list. He'd never worked with blockchain elves before but was excited to see what they could do! They got nearly 100% test coverage, so that's got to be good, right?

The codebase is broken up into 3 contracts:

SantasList.sol
SantaToken.sol
TokenUri.sol

SantasList

Santa's List is the main contract that stores the list of naughty and nice people. It doubles as an NFT contract that people can collect if they are NICE or EXTRA_NICE. In order for someone to be considered NICE or EXTRA_NICE they must be first "checked twice" by Santa.

Once they are checked twice, NICE users can collect their NFT, and EXTRA_NICE users can collect their NFT and they are given SantaTokens. The SantaToken is an ERC20 that can be used to buy the NFT for their NAUGHTY or UNKNOWN friends.

List Checking

In this contract Only Santa to take the following actions:

checkList: A function that changes an address to a new Status of NICE, EXTRA_NICE, NAUGHTY, or UNKNOWN on the original s_theListCheckedOnce list.
checkTwice: A function that changes an address to a new Status of NICE, EXTRA_NICE, NAUGHTY, or UNKNOWN on the new s_theListCheckedTwice list only if someone has already been marked on the s_theListCheckedOnce.

Collecting Presents

You can see what a Christmas NFT present looks like here!

The following functions are meant to be called by people, but only those marked NICE or EXTRA_NICE can benefit from them.

collectNFT: A function that allows a NICE or EXTRA_NICE user to collect their NFT. EXTRA_NICE users also receive SantaToken which is used to purchase an additional NFTs. An address is only allowed to collect 1 NFT per address, there is a check in the codebase to prevent someone from minting duplicate NFTs.
buyPresent: A function that trades 2e18 of SantaToken for an NFT. This function can be called by anyone.

SantaToken

This codebase is based off solmate a Modern, opinionated, and gas optimized building blocks for smart contract development. The ERC20 is a typical ERC20 with the following changes:

Only SantasList can mint tokens
Only SantasList can burn tokens (well, technically anyone can, but only SantasList can call the burn function)

TokenUri.sol

A minimal contract that exclusively has the tokenURI. It's a separate contract inherited by SantasList for readability purposes.

Getting Started

Requirements

git
- You'll know you did it right if you can run git --version and you see a response like git version x.x.x
foundry
- You'll know you did it right if you can run forge --version and you see a response like forge 0.2.0 (816e00b 2023-03-16T00:05:26.396218Z)

Quickstart

git clone https://github.com/Cyfrin/2023-11-Santas-List
cd 2023-11-Santas-List
make

Or optionally, you can run:

forge install
forge build

Usage

Testing

forge test

Test Coverage

forge coverage

and for coverage based testing:

forge coverage --report debug

Audit Scope Details

Commit Hash: 91c8f8c94a9ff2db91f0ab2b2742cf1739dd6374
In Scope:

./src/
#-- SantaToken.sol
#-- SantasList.sol
#-- TokenUri.sol

Compatibilities

Solc Version: 0.8.22
Chain(s) to deploy contract to:
- Arbitrum
Tokens
- SantaToken

Roles

Santa - Deployer of the protocol, should only be able to do 2 things:
- checkList - Check the list once
- checkTwice - Check the list twice
- Additionally, it's OK if Santa mints themselves tokens.
User - Can buyPresents and mint NFTs depending on their status of NICE, NAUGHTY, EXTRA-NICE or UNKNOWN

Known Issues

We are aware that we are missing a number of zero address checks, please ignore.
The Christmas date is approximate, if it's more then 24 hours before or after Christmas, please report that. Otherwise, it's OK.

Rank	Username
1	X XORs33r	663	6 (0)	1 (0)	1
2	w wafflemakr	627	6 (0)	1 (0)	3
3	A Aitor	622	6 (0)	1 (0)	1
4	R Ryan	620	6 (0)	1 (0)	0
5	s shikhar229169	610	5 (0)	1 (0)	1
6	a abhishekthakur	602	6 (0)	0 (0)	1
7	n naman1729	524	5 (0)	1 (0)	2
8	T TAdev	522	4 (0)	0 (0)	1
9	p pacelliv	522	5 (0)	1 (0)	1
10	y y0ng0p3	522	5 (0)	1 (0)	1
11	0 0xspryon	522	5 (0)	1 (0)	1
12	n n0kto	522	5 (0)	1 (0)	1
13	b bobadj	502	5 (0)	0 (0)	1
14	t t0x1c	502	5 (0)	0 (0)	1
15	j jerseyjoewalcott	500	5 (0)	0 (0)	0
16	s spacecowboy	500	5 (0)	0 (0)	0
17	a asimaranov	500	5 (0)	0 (0)	0
18	f f3d0ss	425	4 (0)	1 (0)	2
19	K KiteWeb3	424	4 (0)	1 (0)	2
20	L Leogold	422	4 (0)	1 (0)	1
21	r rocknet	422	4 (0)	1 (0)	1
22	a atlanticbase	422	4 (0)	1 (0)	1
23	m mircha	422	4 (0)	1 (0)	1
24	d dianivanov	422	4 (0)	1 (0)	1
25	M MikeDougherty	422	4 (0)	1 (0)	1
26	w wallebach	420	4 (0)	1 (0)	0
27	K Kaiziron	420	4 (0)	1 (0)	0
28	D Davide	420	4 (0)	1 (0)	0
29	s sobieski	420	4 (0)	1 (0)	0
30	f forkforkdog	420	4 (0)	1 (0)	0
31	R Ryonen	420	4 (0)	1 (0)	0
32	0 0x141414	403	4 (0)	0 (0)	1
33	T Timenov	402	4 (0)	0 (0)	1
34	a ararara	402	4 (0)	0 (0)	1
35	t tk3	402	4 (0)	0 (0)	1
36	0 0xloscar01	402	4 (0)	0 (0)	1
37	a alexbabits	400	4 (0)	0 (0)	0
38	a adnpark	400	4 (0)	0 (0)	0
39	0 0x0bserver	400	4 (0)	0 (0)	0
40	L Louis	324	3 (0)	1 (0)	2
41	0 0x6a70	322	3 (0)	1 (0)	1
42	M Mikea	322	3 (0)	1 (0)	1
43	T TrillionX	322	3 (0)	1 (0)	1
44	r rapstyle	322	3 (0)	1 (0)	1
45	0 0xlamide	322	3 (0)	1 (0)	1
46	D DenTonylifer	322	3 (0)	1 (0)	1
47	n novodelta	322	3 (0)	1 (0)	1
48	J Jaydhales	322	3 (0)	1 (0)	1
49	A AzmaeenGH	322	3 (0)	1 (0)	1
50	B Bube	322	3 (0)	1 (0)	1
51	0 0xbrivan2	320	3 (0)	1 (0)	0
52	g gabr1sr	320	3 (0)	1 (0)	0
53	0 0xAraj	320	3 (0)	1 (0)	0
54	d dougo	320	3 (0)	1 (0)	0
55	0 0xTheBlackPanther	320	3 (0)	1 (0)	0
56	t teddy	320	3 (0)	1 (0)	0
57	C Coffee	320	3 (0)	1 (0)	0
58	0 0xManguebytes	320	3 (0)	1 (0)	0
59	M Martin7777	320	3 (0)	1 (0)	0
60	N Nocturnus	320	3 (0)	1 (0)	0
61	M Mj0ln1r	303	3 (0)	0 (0)	1
62	n naruto	302	3 (0)	0 (0)	1
63	d developerjordy	302	3 (0)	0 (0)	1
64	P Pelz	302	3 (0)	0 (0)	1
65	z zhuying	302	3 (0)	0 (0)	1
66	n nisedo	300	3 (0)	0 (0)	0
67	0 0xeLSeR17	300	3 (0)	0 (0)	0
68	h hack0xield	300	3 (0)	0 (0)	0
69	H Hussareth	300	3 (0)	0 (0)	0
70	A AmritKo	300	3 (0)	0 (0)	0
71	S Sovni	300	3 (0)	0 (0)	0
72	0 0xRolko	300	3 (0)	0 (0)	0
73	w wasny	300	3 (0)	0 (0)	0
74	0 0xfuluz	300	3 (0)	0 (0)	0
75	l luiscfaria	300	3 (0)	0 (0)	0
76	z zanderbyte	300	3 (0)	0 (0)	0
77	p passteque	300	3 (0)	0 (0)	0
78	Y Y403L	224	2 (0)	1 (0)	2
79	T Turetos	222	2 (0)	1 (0)	1
80	k kamuik16	220	2 (0)	1 (0)	0
81	z zach030	220	2 (0)	1 (0)	0
82	P Prabhas	220	2 (0)	1 (0)	0
83	k kevinkien	220	2 (0)	1 (0)	0
84	a aethrouzz	220	2 (0)	1 (0)	0
85	n n4thedev01	220	2 (0)	1 (0)	0
86	b benbo	204	2 (0)	0 (0)	2
87	i innertia	202	2 (0)	0 (0)	1
88	t theFirstElderFr	202	2 (0)	0 (0)	1
89	D Denzi	202	2 (0)	0 (0)	1
90	0 0xMaximus	200	2 (0)	0 (0)	0
91	M Mahmudsudo	200	2 (0)	0 (0)	0
92	I IvanFitro	200	2 (0)	0 (0)	0
93	S SkyHunter	200	2 (0)	0 (0)	0
94	K King	200	2 (0)	0 (0)	0
95	a atoko	200	2 (0)	0 (0)	0
96	d darkart	200	2 (0)	0 (0)	0
97	m musashi	200	2 (0)	0 (0)	0
98	m maziXYZ	200	2 (0)	0 (0)	0
99	A Awacs	200	2 (0)	0 (0)	0
100	d dcheng	200	2 (0)	0 (0)	0

First Flight #5

First Flight #5: Santa's List

Contest Details

Prize Pool

Stats

About

SantasList

List Checking

Collecting Presents

SantaToken

TokenUri.sol

Getting Started

Requirements

Quickstart

Usage

Testing

Test Coverage

Audit Scope Details

Compatibilities

Roles

Known Issues

Leaderboard

Findings

Malicious Test potentially al...

Malicious Code Injection in s...

Any `NICE` or `EXTRA_NICE` us...

SantasList::buyPresent burns ...

All addresses are considered ...

Anyone is able to call `check...

Cost to buy NFT via SantasLis...

Oversized contract will make ...

Christmas timezone + arbitrum...

`buyPresent()` function mints...

Incompatibility of Solidity 0...

collectPresent() can be calle...