First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Changing block.timestamp to collectPrize before Christmas

maziXYZ

Summary

A miner (bad actor) can influence the value of block.timestamp so that they can pass the conditional statement block.timestamp < CHRISTMAS_2023_BLOCK_TIME.

Vulnerability Details

For this vulnerability, a miner (bad actor) can influence the value of block.timestamp so that they can pass the conditional statement block.timestamp < CHRISTMAS_2023_BLOCK_TIME and further more, collectPresent before due date (CHRISTMAS), if other conditions are passed.

Impact

The time check gets bypassed, hence anyone can collectPresent once they have Status value set appropriately.

TEST

// impact of miner changing the block.timestamp value
function testCollectPresent() public {
vm.startPrank(santa);
// 1. let's check `user` Status to be NICE, ONCE & TWICE
santasList.checkList(user, SantasList.Status.NICE);
​
santasList.checkTwice(user, SantasList.Status.NICE);
​
// 2. let's change the block.timestamp value
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME());
​
// 3. let's attack⚔️ (call the collectPresent function)
santasList.collectPresent();
​
// 4. !!! we received a prize (NFT🎑) !!!
assertEq(block.timestamp, santasList.CHRISTMAS_2023_BLOCK_TIME());
}

RESULT

Running the command below:

forge test --match-path test/SantasListPOCTest.t.sol -vv

gives

Running 2 tests for test/SantasListPOCTest.t.sol:SantasListPOCTest
[PASS] testCheckList() (gas: 20519)

Tools Used

  • Forge Framework

  • Manual Review

Recommendations

By using a trusted Oracle (Chainlink Oracles), you can mitigate the risk of timestamp manipulation by miners.

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
maziXYZ Submitter
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.