First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect timegates in `Dussehra::killRavana`

paprikrumplikas

Summary

Dussehra::killRavana is time gated, but the timegates are incorrect.

Vulnerability Details

According to the readme, Dussehra::killRavana is supposed to work only after 12th October 2024 and before 13th October 2024. This time-gating is supposed to be enforced by the following lines:

function killRavana() public RamIsSelected {
@> if (block.timestamp < 1728691069) {
revert Dussehra__MahuratIsNotStart();
}
@> if (block.timestamp > 1728777669) {
revert Dussehra__MahuratIsFinished();
}
IsRavanKilled = true;
uint256 totalAmountByThePeople = WantToBeLikeRam.length * entranceFee;
totalAmountGivenToRam = (totalAmountByThePeople * 50) / 100;
(bool success, ) = organiser.call{value: totalAmountGivenToRam}("");
require(success, "Failed to send money to organiser");
}

However, block.timestamp = 1728691069 corresponds not to the desired date but to Fri Oct 11 2024 23:57:49 GMT+0000.
Similarly, block.timestamp = 1728777669 corresponds not to the desired date but to Sun Oct 13 2024 00:01:09 GMT+0000.

Impact

Dussehra::killRavana can be called in a wider time window than originally intended.

Tools Used

Manual review.

Recommendations

Correct Dussehra::killRavana as follows:

function killRavana() public RamIsSelected {
- if (block.timestamp < 1728691069) {
+ if (block.timestamp < 1728691200)) {
revert Dussehra__MahuratIsNotStart();
}
- if (block.timestamp > 1728777669) {
+ if (block.timestamp < 1728777600) {
revert Dussehra__MahuratIsFinished();
}
IsRavanKilled = true;
uint256 totalAmountByThePeople = WantToBeLikeRam.length * entranceFee;
totalAmountGivenToRam = (totalAmountByThePeople * 50) / 100;
(bool success, ) = organiser.call{value: totalAmountGivenToRam}("");
require(success, "Failed to send money to organiser");
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect timestamp

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.