First Flight #20: The Predicter

Description:

It was noted that block.timestamp is used within ThePredicter.sol and ScoreBoard.sol when making comparisons which is discouraged due to its lack of precision and potential to be manipulated by miners. This variable is currently used when deciding whether a user is able to register, if the prediction window is open and when setting a prediction.

Impact:

The impact will vary depending on the smart contract functionality however, in general, using block.timestamp in time-dependent logic may give malicious individuals a time based advantage. In this case, it may allow a user to register or set a prediction after the time window is closed.

Tooling:

The use of block.timestamp is flagged by most static code analysis tools such as Slither.

Remediation:

It is recommended to use more reliable variables for time-dependent operations such as using block numbers and estimating time based on average block times.