First Flight #12: Kitty Connect

Summary

Shop partner can manipulate cat age leading to possible unfair advantages

Vulnerability Details

When a new cat NFT is minted, shop partner has to set the date of birth (dob) of the cat in seconds. Then in getCatAge function, the age of the cat is calculated based on the date of birth. This lets the shop partner to manipulate the age of the cat and give it an unfair advantage to the cat owner and possibly make the nft rarer due its age.

Impact

Influence the rarity of the cat and can lead to unfair advantages.

Tools Used

Manual Review

Recommendations

Consider using block.timestamp instead of the dob parameter in the getCatAge function.