First Flight #12: Kitty Connect

Summary

CatInfo.dob should not be an arbitrary parameter.

Vulnerability Details

KittyConnect::CatInfo struct has a uint256 dob variable which represents the date of birth of the cat. This variable can have the value desired by the shop partner minting the cat, which is a clear mistake, it should be as follows: dob = block.timestamp;. As we do not have a list of existing cats with their data, it is required to suppose that a new minted cat is born at the moment of minting.

It is even possible to set the date of birth at a time that has not come yet (e.g. year 2100).

Impact

Cats' date of birth is not a reliable variable, calling function KittyConnect::getCatAge() will probably return an incorrect date of birth of the cat. If the set dob is higher than the current time, the function will revert.

Tools Used

Manual review

Recommendations

When minting a new cat, dob should be equal to the current time, not a parameter chosen by the shop partner.