Submission Details
Severity:
SantasList buyPresent() allows user to buyPresent even if Christmas time is not reached.
Summary
buyPresent() has no way of knowing if CHRISTMAS_2023_BLOCK_TIME is reached so if someone decided to they could call this and get a present before CHRISTMAS_2023_BLOCK_TIME.
Vulnerability Details
Allows the user to buy themselves or others a present before Christmas, the whole purpose of the contract is that people can get a present when CHRISTMAS_2023_BLOCK_TIME time is reached.
Impact
Users can exploit this to allow themselves to get a present before CHRISTMAS_2023_BLOCK_TIME.
Tools Used
Manual Review
Recommendations
function buyPresent(address presentReceiver) external {
+ if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {
+ revert SantasList__NotChristmasYet();
+ }
i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}
Updates
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.