First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

```SantaList::collectPresent()``` isn't callable inside the range Christmas 2023 give or take 24 hours

kiteweb3

Summary

SantaList::collectPresent() isn't callable inside the range Christmas 2023 give or take 24 hours as required in the NatSpec description inside the code. The SantaList::collectPresent() is callable from Christmas 2023 onwards.

Vulnerability Details

/*
* @notice Collect your present if you are nice or extra nice. You get extra presents if you are extra nice.
* - Nice: Collect an NFT
* - Extra Nice: Collect an NFT and a SantaToken
@> * This should not be callable until Christmas 2023 (give or take 24 hours), and addresses should not be able to collect more than once.
*/
function collectPresent() external {
@> if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {
revert SantasList__NotChristmasYet();
}
if (balanceOf(msg.sender) > 0) {
revert SantasList__AlreadyCollected();
}
​
...
​
}

Impact

SantaList::collectPresent() isn't callable inside the range Christmas 2023 give or take 24 hours as required in the NatSpec description inside the code. The SantaList::collectPresent() is callable from Christmas 2023 onwards. The code seems to be not aligned with the project requirements.

Tools Used

Manual review.

Recommendations

Add a 24h range condition in the SantaList::collectPresent() function.

function collectPresent() external {
- if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {
+ if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME - 1 days || block.timestamp > CHRISTMAS_2023_BLOCK_TIME + 1 days) {
​
revert SantasList__NotChristmasYet();
}
​
if (balanceOf(msg.sender) > 0) {
revert SantasList__AlreadyCollected();
}
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

collectPresent is callable after Christmas

check on block.timestamp only requires that christmas has arrived. The protocol explicitly states that after christmas has passed (give or take 24 hours) collecting shouldn't be possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.