First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`block.timestamp` Can Be Manipulated By Miners

nem0x001

block.timestamp Can Be Manipulated By Miners

Description:

There are instances of block.timestamp comparisons in ChoosingRam::increaseValuesOfParticipants ,ChoosingRam::selectRamIfNotSelectedand Dussehra::killRavana which can be influenced by miners to a certain degree,which can affect protocol functionallity

​
function increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyPerticipent)
public
RamIsNotSelected
{
if (tokenIdOfChallenger > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfChallenger();
}
if (tokenIdOfAnyPerticipent > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfPerticipent();
}
if (ramNFT.getCharacteristics(tokenIdOfChallenger).ram != msg.sender) {
revert ChoosingRam__CallerIsNotChallenger();
}
//Note:This can be manipulated by the miner
if (block.timestamp > 1728691200) {
revert ChoosingRam__TimeToBeLikeRamFinish();
}
}
​
​
function selectRamIfNotSelected() public RamIsNotSelected OnlyOrganiser {
//Note:This can be manipulated by the miner
if (block.timestamp < 1728691200) {
revert ChoosingRam__TimeToBeLikeRamIsNotFinish();
}
//Note:This can be manipulated by the miner
if (block.timestamp > 1728777600) {
revert ChoosingRam__EventIsFinished();
}
}
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Too generic
Assigned finding tags:

Weak randomness in `ChoosingRam::increaseValuesOfParticipants`

nem0x001 Submitter
about 1 year ago
bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak randomness in `ChoosingRam::selectRamIfNotSelected`

The organizer is trusted, but the function `ChoosingRam::selectRamIfNotSelected` uses a way to generate a random number that is not completely random.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.