First Flight #5: Santa's List

Summary

The collectPresent() function within the SantasList contract is vulnerable to a Denial-of-Service (DoS) attack due to its reliance on a time-based condition that can be manipulated.

Vulnerability Details

The vulnerability stems from the contract's dependence on block.timestamp < CHRISTMAS_2023_BLOCK_TIME to restrict present collection before Christmas 2023. This approach is susceptible to manipulation through transaction spamming, delaying block mining and causing network congestion.

Impact

An attacker exploiting this vulnerability can artificially increase block timestamps, so that the condition is never true and it always reverts

Tools Used

manual analysis

Recommendations

use an oracle like chainlink to get the actual time