Summary

users can collectPresent before scheduled time or 1 hour later due to the way block.timestamp is calculated on Arbitrum.

Vulnerability Details

collectPresent function check if current time is greator than CHRISTMAS_2023_BLOCK_TIME then allow, else revert. But Arbitrum don't follow the L1 block.timestamp instead it relies on sequencer clock.
Here is how arbitrum handles block.timestamp -

• Must be always equal or greater than the previous L2 block timestamp

• Must fall within the established boundaries (24 hours earlier than the current time or 1 hour in the future). More on this can be Read Here
  
  -so as per current scenario, it's highly possible than users will be able to mint 24 hours earlier.

Impact

User can collectPresent before time or 1 hour late

Tools Used

Manual Review

Recommendations

To keep it near possible date, CHRISTMAS_2023_BLOCK_TIME can be increased to 23 hours.