First Flight #5: Santa's List

Summary

Present can be minted before Christmas time

Vulnerability Details

According the the project details, SantasList::collectPresent function should not be called before a specific timestamp, set as a constant in the contract. The function uses block.timestamp to validate if the user is allowed to proceed. This timestamp can be manipulated and allow users to mint before CHRISTMAS_2023_BLOCK_TIME.

Impact

MEDIUM, as it will require a lot of resources to manipulate time.

Tools Used

• Manual Review

Recommendations

Only possible solution is to set a boolean flag instead, only by Santa, initiating the minting process.