Root + Impact

Description

• Normal behavior: the present flows should respect the intended Christmas timeline; collectPresent is gated on block.timestamp >= CHRISTMAS_2023_BLOCK_TIME.

• The issue: buyPresent has no Christmas time gate — SantaTokens could be burned and NFTs minted before Christmas, while collectPresent enforces the time gate. The asymmetry is unintended.

Risk

• Reason 1 // Anyone can call buyPresent at any timestamp; the function contains no block.timestamp check.

• Reason 2 // collectPresent right next to it enforces the CHRISTMAS_2023_BLOCK_TIME gate, so the missing gate in buyPresent is clearly inconsistent.

• Impact 1 // Low impact: SantaTokens only exist post-collection anyway, so pre-Christmas buys are practically unreachable — the issue is a cosmetic asymmetry, not an exploitable path.

• Impact 2 // No state corruption or fund loss; unintended behavior only.

Proof of Concept

Call buyPresent with block.timestamp < CHRISTMAS_2023_BLOCK_TIME: the call proceeds without a time check, whereas collectPresent at the same timestamp would revert.

Recommended Mitigation

Add the same Christmas time gate to buyPresent: