Santa's List
AI First Flight #3
Beginner FriendlyFoundry
EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`SantasList::collectPresent()` has no closing date and remains callable indefinitely after Christmas 2023

arush

[L-01] SantasList::collectPresent() has no closing date and remains callable indefinitely after Christmas 2023

Description:

collectPresent() only enforces a lower time bound — block.timestamp >= CHRISTMAS_2023_BLOCK_TIME — and never an upper bound. Combined with the fact that checkList()/checkTwice() carry no time restriction either, the naughty-or-nice window never closes: Santa can check people long after Christmas 2023 has passed, and any address that becomes (or, per [H-02], defaults to) NICE/EXTRA_NICE can collect at any point in the future — next year, in five years, indefinitely — with no relationship to the one-time "Christmas 2023" event the contract is named after.

Risk Analysis:

  • Impact: Low — no fund-safety impact; purely a deviation from the intended one-time, time-boxed Christmas event.

  • Likelihood: Medium — requires no special conditions to trigger; it happens by default simply as time passes, though it doesn't independently increase attacker capability beyond what [H-01]/[H-02] already grant.

Proof of Concept:

Foundry test function to prove the vulnerability.

function testCollectPresentStillCallableYearsLater() public {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.NICE);
santasList.checkTwice(user, SantasList.Status.NICE);
vm.stopPrank();
// Warp to well beyond Christmas 2023
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 5 * 365 days);
vm.prank(user);
santasList.collectPresent(); // still succeeds
assertEq(santasList.balanceOf(user), 1);
}

Recommended Mitigation:

Add an explicit closing timestamp for the collection window.

+ uint256 public constant COLLECTION_WINDOW_CLOSE = CHRISTMAS_2023_BLOCK_TIME + 30 days;
function collectPresent() external {
if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {
revert SantasList__NotChristmasYet();
}
+ if (block.timestamp > COLLECTION_WINDOW_CLOSE) {
+ revert SantasList__CollectionWindowClosed();
+ }
...
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 14 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[L-01] collectPresent() can be called at anytime after christmas

## Description The christmas present should only be collected with 24 hours before or after christmas. But the present can be minted at anytime after christmas. ## Vulnerability Details Documenation mentioned that "The Christmas date is approximate, if it's more then 24 hours before or after Christmas, please report that. Otherwise, it's OK." The `collectPresent()` has only checked that the present cannot be collected before the christmas. But hasn't checked in the case of after christmas collection. ```javascript function collectPresent() external { if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) { revert SantasList__NotChristmasYet(); } if (balanceOf(msg.sender) > 0) { revert SantasList__AlreadyCollected(); } if (s_theListCheckedOnce[msg.sender] == Status.NICE && s_theListCheckedTwice[msg.sender] == Status.NICE) { _mintAndIncrement(); return; } else if ( s_theListCheckedOnce[msg.sender] == Status.EXTRA_NICE && s_theListCheckedTwice[msg.sender] == Status.EXTRA_NICE ) { _mintAndIncrement(); i_santaToken.mint(msg.sender); return; } revert SantasList__NotNice(); } ``` `uint256 public constant CHRISTMAS_2023_BLOCK_TIME = 1_703_480_381;` The UTC time for this epoch is : `Monday, 25 December 2023 04:59:41` . The present can only be collected after approx 5 hours after the christmas arrived. But it can be collectable at anytime after Christmas. As there is no check for the after christmas case. ## Impact The impact of this vulnerability is that the intended use of the protocol is not acquired. Proof Of Code : ```javascript function testCollectPresentNiceAfterChristmas() public { vm.startPrank(santa); santasList.checkList(user, SantasList.Status.NICE); santasList.checkTwice(user, SantasList.Status.NICE); vm.stopPrank(); vm.warp(1703900189); // Saturday, 30 December 2023 01:36:29 vm.startPrank(user); santasList.collectPresent(); assertEq(santasList.balanceOf(user), 1); vm.stopPrank(); } ``` Add this test to `SantasListTest.t.sol` and run `forge test --mt testCollectPresentNiceAfterChristmas` to test. You can observe that the present is collectable at Saturday, 30 December 2023 01:36:29. ## Recommendations Include check for the after 24 hours of christmas. ```diff function collectPresent() external { - if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) { + if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME && block.timestamp > 1703554589 ) { revert SantasList__NotChristmasYet(); } if (balanceOf(msg.sender) > 0) { revert SantasList__AlreadyCollected(); } if (s_theListCheckedOnce[msg.sender] == Status.NICE && s_theListCheckedTwice[msg.sender] == Status.NICE) { _mintAndIncrement(); return; } else if ( s_theListCheckedOnce[msg.sender] == Status.EXTRA_NICE && s_theListCheckedTwice[msg.sender] == Status.EXTRA_NICE ) { _mintAndIncrement(); i_santaToken.mint(msg.sender); return; } revert SantasList__NotNice(); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!