Santa's List

AI First Flight #3
Beginner FriendlyFoundry
EXP
View results
Submission Details
Impact: low
Likelihood: low
Invalid

CHRISTMAS_2023_BLOCK_TIME is a hardcoded past timestamp, so the collectPresent time-gate is permanently open instead of guarding a date

Hardcoded past Christmas timestamp makes the time gate permanently open

Description

CHRISTMAS_2023_BLOCK_TIME is a fixed constant equal to a December 2023 instant. The collectPresent time gate checks block.timestamp < CHRISTMAS_2023_BLOCK_TIME, which is permanently false now, so the intended "not callable until Christmas" restriction no longer exists.

// SantasList.sol:86
uint256 public constant CHRISTMAS_2023_BLOCK_TIME = 1_703_480_381; // @> past timestamp (Dec 2023)
// SantasList.sol:148
if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {
revert SantasList__NotChristmasYet();
}

Risk

Likelihood: Low

The timing logic itself is correct; the issue is the hardcoded constant has already elapsed. Whether this matters depends on intent, but the effect is that the gate is now unconditionally satisfied.

Impact: Low

The time-lock provides no protection on any current deployment, so present collection is always open regardless of date. If the design depended on holding collection until a future event, that control is absent.

Proof of Concept

Collection succeeds at the current block time with no warp into the future.

function test_timeGateAlreadyOpen() public {
// no vm.warp forward needed; current timestamp already exceeds the constant
assertGe(block.timestamp, santasList.CHRISTMAS_2023_BLOCK_TIME());
}

Recommended Mitigation

Use a configurable or clearly future date, or document that the gate is intentionally inert.

- uint256 public constant CHRISTMAS_2023_BLOCK_TIME = 1_703_480_381;
+ uint256 public immutable i_unlockTime; // set in constructor to a future timestamp
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!