The christmas present should only be collected with 24 hours before or after christmas. But the present can be minted at anytime after christmas.
Documenation mentioned that "The Christmas date is approximate, if it's more then 24 hours before or after Christmas, please report that. Otherwise, it's OK."
The collectPresent()
has only checked that the present cannot be collected before the christmas. But hasn't checked in the case of after christmas collection.
uint256 public constant CHRISTMAS_2023_BLOCK_TIME = 1_703_480_381;
The UTC time for this epoch is : Monday, 25 December 2023 04:59:41
.
The present can only be collected after approx 5 hours after the christmas arrived. But it can be collectable at anytime after Christmas. As there is no check for the after christmas case.
The impact of this vulnerability is that the intended use of the protocol is not acquired.
Proof Of Code :
Add this test to SantasListTest.t.sol
and run forge test --mt testCollectPresentNiceAfterChristmas
to test.
You can observe that the present is collectable at Saturday, 30 December 2023 01:36:29.
Manual Review
Include check for the after 24 hours of christmas.
check on block.timestamp only requires that christmas has arrived. The protocol explicitly states that after christmas has passed (give or take 24 hours) collecting shouldn't be possible.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.