time-manipulation

Time Manipulation

block.timestamp Manipulation

Validators/miners have limited control over block.timestamp:

• Must be greater than parent block's timestamp
• Must be within ~15 seconds of real time (consensus rule)
• Post-merge: fixed 12-second slots, but validator chooses timestamp within bounds

// Safe for: time ranges > 15 seconds
// Unsafe for: precise sub-minute timing, randomness

// VULNERABLE: exact-second conditions
if (block.timestamp == auctionEnd) { ... } // may never be true

// SAFE: range-based conditions
if (block.timestamp >= auctionEnd) { ... } // will always become true

Time-Dependent Logic Risks

Unlock Schedule Gaming

// VULNERABLE: cliff unlock at exact timestamp
function claimVested() external {
    if (block.timestamp < cliff) revert NotVested();
    uint256 amount = totalAllocation; // full amount at cliff
    _transfer(msg.sender, amount);
}

// Risk: validator can set timestamp to just past cliff in their block
// This allows early claiming relative to wall clock time

// SAFE: linear vesting reduces impact of timestamp manipulation
function claimVested() external {
    uint256 elapsed = block.timestamp - vestingStart;
    if (elapsed == 0) revert NotVested();

    uint256 totalDuration = vestingEnd - vestingStart;
    uint256 vested = totalAllocation * Math.min(elapsed, totalDuration) / totalDuration;
    uint256 claimable = vested - alreadyClaimed[msg.sender];

    if (claimable == 0) revert NothingToClaim();

    alreadyClaimed[msg.sender] += claimable;
    token.safeTransfer(msg.sender, claimable);
}

Cooldown Bypass

// VULNERABLE: short cooldown can be bypassed by timestamp manipulation
uint256 public constant COOLDOWN = 30 seconds;

mapping(address => uint256) public lastAction;

function doAction() external {
    if (block.timestamp - lastAction[msg.sender] < COOLDOWN) revert Cooldown();
    lastAction[msg.sender] = block.timestamp;
    // A validator can set timestamp 30s ahead to bypass cooldown
}

// SAFER: use block numbers for short cooldowns
uint256 public constant COOLDOWN_BLOCKS = 3; // ~36 seconds

mapping(address => uint256) public lastActionBlock;

function doAction() external {
    if (block.number - lastActionBlock[msg.sender] < COOLDOWN_BLOCKS) revert Cooldown();
    lastActionBlock[msg.sender] = block.number;
}