Summary

The owner is allowed to close the pot 90 days after it was created. However, the pot is vulnerable to block timestamp manipulation upon deployment of the Pot contract.

Vulnerability Details

The vulnerability lies in line 28 of the Pot contract.

The variable i_deployedAt intends to store the timestamp when the Pot contract is deployed. A malicious miner can manipulate the timestamp of the block in which the contract deployment's transaction is mined, causing i_deployedAt to be set to a future timestamp.

Impact

The vulnerability would lead to an unexpected behavior when the pot cannot be closed 90 days after the Pot contract is deployed, and can only be closed at a future timestamp.

Tools Used

Foundry, manual review

Recommended Mitigation

To mitigate this vulnerability, the Pot contract should use the timestamp of a reliable and trusted external oracle and set it as the deployed time.