# KeyringCoreV2Base::_createCredential() could use currentTime instead of block.timestamp on the creatBefore check Low/Info · Three Sigma · Zero-knowledge compliance · 10th July, 2024 Finding 3S-Keyring-N01 of the Keyring Credentials security review. - Protocol: https://www.keyring.network/ - Report: /reports/keyring-ii - Source: https://cdn.sanity.io/files/qoqld077/production/75b68b74f4b0dc6fbcd94892d934547d8259b57a.pdf --- ### Description KeyringCoreV2Base::_createCredential() checks that the current block.timestamp has not exceeded creatBefore by doing: ```solidity if (block.timestamp > creatBefore) { revert ErrInvalidCredential(policyId, tradingAddress, "EPO"); } ``` It could use currentTime instead as it has been cached. ### Recommendation ```solidity if (currentTime > creatBefore) { revert ErrInvalidCredential(policyId, tradingAddress, "EPO"); } ``` ### Status Addressed in [#ffe8b11](https://github.com/Keyring-Network/core-v2/commit/ffe8b11b3c8b1eaadb1713eb19e80872a9d1c630). --- Related findings: - [Swapping with deadline as block.timestamp and 0 minimum amount out is vulnerable to MEV](https://0xsimao.com/findings/clip-finance-i-swapping-deadline-timestamp-mev): Clip Finance Strategies - [`rewardData.releaseRate` is incorrectly calculated on `RewardsController::config()` when `block.timestamp > start` and `rewardData.lastConfig != rewardData.start`](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-reward-release-rewards-timestamp): Exactly Protocol Update - Staking Contract - [UniswapV2Swapper uses block.timestamp for deadline [Out of scope]](https://0xsimao.com/findings/fuji-finance-uniswap-timestamp-deadline-scope): Fuji Finance - [API3 oracle timestamp can be set to future timestamp and block API3 Oracle usage to make code revert in underflow](https://0xsimao.com/findings/init-capital-ii-oracle-timestamp-revert-underflow): INIT Capital