Santa's List
AI First Flight #3
Beginner FriendlyFoundry
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Christmas timestamp is hardcoded to a past date, permanently disabling the time gate on any current or future deployment

blackburn

Root + Impact

The CHRISTMAS_2023_BLOCK_TIME constant is hardcoded to December 25, 2023. On any deployment after that date, block.timestamp < CHRISTMAS_2023_BLOCK_TIME is permanently false, meaning the time gate in collectPresent() never triggers. The intended "not before Christmas" protection is a no-op from the moment the contract is deployed.

This affects every deployment of the contract from January 1, 2024 onwards — which includes any current or future deployment. No attacker action is required. The condition is broken by default on all live instances.

Description

  • collectPresent() is intended to prevent users from claiming presents before Christmas Day. The guard uses a hardcoded constant:

// @> hardcoded to Dec 25 2023 — permanently in the past on any current deployment
uint256 public constant CHRISTMAS_2023_BLOCK_TIME = 1_703_480_381;
​
function collectPresent() external {
// @> this condition is always false after Dec 25 2023
if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {
revert SantasList__NotChristmasYet();
}
...
}

1_703_480_381 corresponds to approximately 2023-12-25 00:59:41 UTC. Since block.timestamp on any chain today is well beyond this value, the check block.timestamp < 1_703_480_381 is always false and collectPresent() is immediately callable upon deployment — regardless of the actual date.

For any redeployment or reuse of this contract, the protection is completely absent. Anyone can call collectPresent() in the same block as deployment.

Risk

Likelihood:

  • Affects 100% of deployments after December 25, 2023 with no attacker action required

  • The time gate is silently disabled — no error, no revert, no indication

Impact:

  • The intended pre-Christmas lockout period is permanently bypassed

  • Users can collect presents immediately upon deployment — Santa has no time to build the list before claims begin

  • Undermines the protocol's intended operational sequence: Santa checks the list first, then Christmas unlocks collection

Recommended Mitigation

Set the unlock timestamp as a constructor parameter so it can be configured at deployment time rather than hardcoded to a past date.

- uint256 public constant CHRISTMAS_2023_BLOCK_TIME = 1_703_480_381;
​
+ uint256 public immutable i_christmasTimestamp;
​
constructor() ERC721("Merry Christmas 2023", "SANTA") {
i_santa = msg.sender;
i_santaToken = new SantaToken(address(this));
+ i_christmasTimestamp = block.timestamp + 30 days; // or pass as parameter
}
​
function collectPresent() external {
- if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {
+ if (block.timestamp < i_christmasTimestamp) {
revert SantasList__NotChristmasYet();
}
...
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 4 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!