1

I am using block.timestamp for some critical part of my code. What should I be aware of? What can miners do? Can they fake it? Delay it? Make it go back in time? If yes, what would it take them to do it? Is it expensive for them to fake it?

1 Answer 1

1

One instance where you'd need to be extra careful would be to avoid using block.timestamp as a source of randomness. block.timestamp often produces pseudo-random numbers and it might be tempting to use it as an RNG, but it has a critical vulnerability as it could be influenced by the miner. If a miner had enough incentive, he could mine his blocks with incorrect timestamps to manipulate the outcome of a random function to his favor.

There are other instances where block.timestamp is not used as a source of randomness, but the smart contract functionality is still critically time-dependent and thus extremely vulnerable to minter attacks. Here's a real-world example taken from a HackerNoon article:

GovernMental was an old Ponzi scheme that accumulated quite a large amount of ether. It was also vulnerable to a timestamp-based attack. The contract payed out to the player who was the last player to join (for at least one minute) in a round. Thus, a miner who was a player, could adjust the timestamp (to a future time, to make it look like a minute had elapsed) to make it appear that the player was the last to join for over a minute (even though this is not true in reality). More detail on this can be found in the History of Ethereum Security Vulnerabilities Post by Tanya Bahrynovska.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.