wrong MONTH_IN_SECONDS constant

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-forgeries/blob/main/src/VRFNFTRandomDraw.sol#L33

Vulnerability details

Impact

Wrong constant leads to unexpected long time can be set for settings.drawBufferTime and settings.recoverTimelock

Proof of Concept

uint256 immutable MONTH_IN_SECONDS = (3600 * 24 * 7) * 30;

this actually is 7 month.

In this setting settings.recoverTimelock can be as large as 12*7 month (7 years) instead of a year, and likewise REDRAW_TIMELOCK_NEEDS_TO_BE_LESS_THAN_A_MONTH will only prevent _settings.drawBufferTime larger than 7 months.

Tools Used

no

Recommended Mitigation Steps

should be changed to uint256 immutable MONTH_IN_SECONDS = 3600 * 24 * 30;

[c4-judge]

gzeon-c4 marked the issue as duplicate of #273

[c4-judge]

gzeon-c4 marked the issue as satisfactory