First Flight #5: Santa's List

Summary

A User cannot Collect Presents less than 24 hours before Christmas, contrary to what the About/code says:

//This variable is ok even if it's off by 24 hours. uint256 public constant CHRISTMAS_2023_BLOCK_TIME = 1_703_480_381;

Vulnerability Details

The check
if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {revert SantasList__NotChristmasYet();}
means that ONLY block.timestamps after or equal to CHRISTMAS_2023_BLOCK_TIME pass the check and can collect Presents.

Impact

Means that users wanting to collect their present <24hours before the CHRISTMAS_2023_BLOCK_TIME, cannot do so.

Low Impact as they can just wait and collect their present after the timestamp has passed this value.

Tools Used

manual

Recommendations

change to:
if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME - 7200) {revert SantasList__NotChristmasYet();}

Note this only fixes this specific vulnerability, there is a another block time related vulnerability this fix does not solve.