1

I am planning on launching an ICO and have been reading through the security recommendations for writing solidity contracts.

My ICO checks if the deadline has been reached by using

if(now >= deadline){ 
    isClosed = true; 
}

From looking at the other answers on here, I have gathered that a miner with significant power can manipulate the time if there was such incentive for him to do so (i.e. if the contract depends on the timestamp).

Would it be secure to use 'now' in my contract if it is simply checking to see if time has passed the deadline? Which in turn, would release funds only to specified people (so the miner would have no incentive to maliciously alter time)?

PS: I realise there are similar Q&A's out there, but given the recent hype with ICO's I feel it may be appropriate to clarify this for myself and future ICO developers with the case of specifying a deadline.

Thanks everyone.

1

To clarify OpenZeppelin use 'now' in there contracts which have been successfully used in multiple ICO's.

Therefore, I believe this would be an acceptable case to use the 'now' function when verifying time. I believe this is because, like stated in the question, there is no financial incentive for the attacker to maliciously alter time and due to the deadline triggering 'any time after X' it doesn't matter too much if the timestamp is slightly off.

https://github.com/OpenZeppelin/zeppelin-solidity/blob/master/contracts/crowdsale/Crowdsale.sol

  • It really depends on the contract. For example BAT was sold out in just 3 blocks. If they used timestamp being able to modify the timestamp of the block is a huge advantage. But you are right for most contracts is not really an issue. – Ismael Nov 29 '17 at 18:12
  • Okay yes very good point, so is there any other way to get around this from a security perspective? Or is this simply just a slight disadvantage when using de-centralised systems (where the time is not definite) – Jack Pickering Dec 1 '17 at 14:22
  • When block intervals are predictable using block numbers is similar to use a timestamp. But when the difficulty bomb was seriously altering the intervals previous to the byzantinum fork it was hard to use and using timestamp was the best option. – Ismael Dec 1 '17 at 14:56
1

There is no difference between the two. They both refer to current block timestamp as seconds since unix epoch. The other option for measuring time is to use block.number.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.