Skip to content

block.timestamp Used in a Strict Equality

SAFE-0309 Time Dependence Checked automatically by the scanner
1

What goes wrong

Logic compares block.timestamp (or block.number) with == / !=. Validators have minor leeway over the timestamp and exact equality is brittle — the condition may never hold, or a miner can nudge it, breaking timing-sensitive logic.

2

The vulnerable pattern

proof of concept — how it is exploited
// require(block.timestamp == unlockTime);  // almost never exactly true
// the unlock either never fires, or a validator sets the exact timestamp
// to control when it does.
3

How to fix it

the pattern that is safe
// use range comparisons, never strict equality on block values
require(block.timestamp >= start && block.timestamp <= end, "window");
Compare block values with ranges, not equality.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0309 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs