The collectPresent can be called any number of days past Christmas.
Summary
The document says The Christmas date is approximate, if it's more then 24 hours before or after Christmas, please report that. However, you can still acquire the gift no matter how many days past.
Vulnerability Details
In collectPresent(), revert when block.timestamp < CHRISTMAS_2023_BLOCK_TIME. This will prevent this function from being invoked until CHRISTMAS_2023_BLOCK_TIME is exceeded, but there is no restriction on how much it has exceeded, so this function can be invoked any number of days later.
Impact
The function can be used at a time that does not conform to the specifications.
Tools Used
Manual
Recommendations
Add a constraint that a function cannot be started after one day over Christmas.
Lead Judging Commences
collectPresent is callable after Christmas
check on block.timestamp only requires that christmas has arrived. The protocol explicitly states that after christmas has passed (give or take 24 hours) collecting shouldn't be possible.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.