Santa's List

Description

• collectPresent enforces a time-lock intended to prevent NFT collection before Christmas Day, using a hardcoded Unix
  timestamp corresponding to December 25, 2023.

• CHRISTMAS_2023_BLOCK_TIME = 1_703_480_381 is already in the past on any network. On any deployment made after December
  2023, block.timestamp always exceeds this value, meaning the NotChristmasYet revert is never triggered and the seasonal
  restriction provides zero protection from the first block of deployment.

// @> Hardcoded to Christmas 2023 — permanently in the past on any post-2023 deployment
uint256 public constant CHRISTMAS_2023_BLOCK_TIME = 1_703_480_381;

function collectPresent() external {
// @> This check always passes — block.timestamp already exceeds this value
if (block.timestamp santasList.CHRISTMAS_2023_BLOCK_TIME());

  // collectPresent succeeds with no time manipulation at all                                                         
  vm.prank(user);
  santasList.collectPresent();                                                                                        
  assertEq(santasList.balanceOf(user), 1);              

}

Recommended Mitigation

Accept the Christmas timestamp as a constructor parameter so it can be set to a future date on each deployment:

• uint256 public constant CHRISTMAS_2023_BLOCK_TIME = 1_703_480_381;

• uint256 public immutable i_christmasTimestamp;

• constructor() ERC721("Merry Christmas 2023", "SANTA") {

• constructor(uint256 christmasTimestamp) ERC721("Merry Christmas 2023", "SANTA") {

• require(christmasTimestamp > block.timestamp, "Must be a future date");                                           
  

• i_christmasTimestamp = christmasTimestamp;          
  i_santa = msg.sender;
  i_santaToken = new SantaToken(address(this));
  

  }

  function collectPresent() external {

• if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {
  

• if (block.timestamp < i_christmasTimestamp) {
      revert SantasList__NotChristmasYet();                                                                         
  }