First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`Dussehra::killRavana` function can be called before 12th october and after 13th october

codexbugmenot

Summary

The function Dussehra::killRavana has an invariant documented that it can only be called between 12th October and 13th October but the block.timestamp checks in the function do not correspond to documented time allowing users to call this function before 12th October and after 13th October

Vulnerability Details

Dussehra::killRavana function can be called before 12th October and after 13th October

The timestamps corresponding to the times are:

  1. 12th October 2024 00:00:00 - 1728691200

  2. 13th October 2024 00:00:00 - 1728777600

but the times in the function are:

  1. 11th October 2024 23:57:49 - 1728691069

  2. 13th October 2024 00:01:09 - 1728777669

​
function killRavana() public RamIsSelected {
@> if (block.timestamp < 1728691069) {
revert Dussehra__MahuratIsNotStart();
}
@> if (block.timestamp > 1728777669) {
revert Dussehra__MahuratIsFinished();
}
​
....
...
..
.
}
​

Impact

If Ram is selected any user can call Dussehra::killRavana before the Mahurat even starts which would ruin the festivity for other participants who'd want the event to happen during the Mahurat Time.

Tools Used

  1. Manual Review

  2. Foundry

Recommendations

Changing the Timestamps to their corresponding ones will mitigate the issue

In the Dussehra::killRavana function make the following changes

​
function killRavana() public RamIsSelected {
- if (block.timestamp < 1728691069) {
+ if (block.timestamp < 1728691200) {
}
revert Dussehra__MahuratIsNotStart();
}
- if (block.timestamp > 1728777669) {
+ if (block.timestamp > 1728777600) {
}
revert Dussehra__MahuratIsFinished();
}
​
....
...
..
.
}
​
​
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect timestamp

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.