vkonst / ctd-token

Smart-contracts for Cointed Token and Token Sale
11 stars 9 forks source link

Timestamp usage #1

Closed pauliax closed 6 years ago

pauliax commented 6 years ago

OpenZeppelin recommendation: There’s a problem with using timestamps and now (alias for block.timestamp) for contract logic, based on the fact that miners can perform some manipulation. In general, it’s better not to rely on timestamps for contract logic. The solution is to use block.number instead, and approximate dates with expected block heights and time periods with expected block amounts. Of course, the possibility of manipulation is very low, so this is not a must-implement suggestion, more just like a note to let you know about it.

pauliax commented 6 years ago

This issue is no longer relevant as according to the latest OpenZeppelin recommendation: "The current recommendation is to use timestamps instead. The risk of miner manipulation of timestamps is very low for this use case, and due to the Difficulty Bomb it is now very difficult to correctly estimate future block times. Consider switching to timestamps." More: https://blog.zeppelin.solutions/global-messaging-token-audit-865e6a821cd8

vkonst commented 6 years ago

Not an issue

Block times are subject to the following constraints:

However, a powerful miner to manipulate timestamps over short periods. A hypothetical small difference between the network time and the "real time" does not jeopardize the campaign in any way.

Thank you for your input.