code-423n4 / 2021-10-mochi-findings

0 stars 0 forks source link

Avoid Using Block.timestamp in checkClaimable #145

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

Koustre

Vulnerability details

Impact

checkClaimable function is dependent on using block.timestamp and this can be manipulated to claim funds earlier than it should in functions claim, forceClaim and lock

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Recommended Mitigation Steps

use block.number instead

r2moon commented 3 years ago

reason is not correct

ghoul-sol commented 3 years ago

If block timestamp is manipulated by miner then it's manipulated for everyone. I don't see explicit exploit example here so making this invalid.