First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

HardCoding the timestamps renders the contracts unusable after one Dussehra event

codexbugmenot

Summary

The contracts ChoosingRam.sol and Dussehra.sol have hard-coded time stamps for 12th October 2024 and 13th October 2024 which renders the contracts unusable after the 2024 Dussehra event

Vulnerability Details

The Constructors of the contracts take in Contract addresses and also the RamNFT.sol has a function setChoosingRamContract which suggests reusability of contracts every year but hard-coding the timeStamp Values in the contracts makes the contracts usable only for one Dussehra event

  1. In ChoosingRam.sol

​
function increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyPerticipent)
public
RamIsNotSelected
{
if (tokenIdOfChallenger > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfChallenger();
}
if (tokenIdOfAnyPerticipent > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfPerticipent();
}
if (ramNFT.getCharacteristics(tokenIdOfChallenger).ram != msg.sender) {
revert ChoosingRam__CallerIsNotChallenger();
}
​
@> if (block.timestamp > 1728691200) {
revert ChoosingRam__TimeToBeLikeRamFinish();
}
...
..
.
​
function selectRamIfNotSelected() public RamIsNotSelected OnlyOrganiser {
@> if (block.timestamp < 1728691200) {
revert ChoosingRam__TimeToBeLikeRamIsNotFinish();
}
@> if (block.timestamp > 1728777600) {
revert ChoosingRam__EventIsFinished();
}
​

  1. In Dussehra.sol

function killRavana() public RamIsSelected {
@> if (block.timestamp < 1728691069) {
revert Dussehra__MahuratIsNotStart();
}
@> if (block.timestamp > 1728777669) {
revert Dussehra__MahuratIsFinished();
}
....
..
.

Impact

The HardCoded Time Stamps have to be Changed for every Deployment every year

Tools Used

  1. Manual Review

  2. Foundry

Recommendations

Instead of changing the HardCoded Values the timestamps for Dussehra Mahurat can be passed as args in the constructor which allows the organiser the flexibility to re-use the same contracts for multiple years.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid according to docs

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.