KeyringCoreV2Base::_createCredential() could use currentTime instead of block.timestamp on the creatBefore check

Low/InfoKeyring Credentials audit·Three Sigma·Zero-knowledge compliance·10th July, 20243S-Keyring-N01

Description

KeyringCoreV2Base::_createCredential() checks that the current block.timestamp has not exceeded creatBefore by doing:

solidity

if (block.timestamp > creatBefore) {
    revert ErrInvalidCredential(policyId, tradingAddress, "EPO");
}

It could use currentTime instead as it has been cached.

Recommendation

solidity

if (currentTime > creatBefore) {
    revert ErrInvalidCredential(policyId, tradingAddress, "EPO");
}

Status

Addressed in #ffe8b11.

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests