President Elector

First Flight #24
Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: low
Invalid

Use of `block.timestamp` for Time Calculations

Description: The contract uses block.timestamp to manage time-based logic, such as determining when the voting period ends. While block.timestamp is generally reliable, it can be manipulated slightly by miners, which might affect time-sensitive operations.

Impact:

  • Minor Timestamp Manipulation: Miners can manipulate the timestamp by a few seconds, which could potentially affect the timing of critical operations, such as the start or end of a voting period.

  • Potential Exploitation: In scenarios where precise timing is crucial, this manipulation could be exploited to gain a slight advantage.

Proof of Concept: The contract uses block.timestamp in the selectPresident function to check if the voting period has ended:

if (block.timestamp - s_previousVoteEndTimeStamp <= i_presidentalDuration) {
revert RankedChoice__NotTimeToVote();
}

Recommended Mitigation:

  • Allow for Time Buffer: Implement a buffer period to account for potential minor timestamp manipulation, ensuring that critical operations are not affected by small changes.

  • Use Block Number for Critical Timing: For operations where precise timing is crucial, consider using block numbers instead of timestamps, as they are less susceptible to manipulation.

  • Document Assumptions: Clearly document any assumptions related to time calculations and the potential impact of timestamp manipulation.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.