Root + Impact

Description

• Attacker can call the buySnow function with parameter amount=0 always, so that the variable s_earnTimer will constantly be updated to block.timestamp

• When a user want to call the earnSnowfunction, thes_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weekswill always be true and will revert, causing Dos attack.

  function buySnow(uint256 amount) external payable canFarmSnow {

  // @audit -check what if msg.value != 0 and msg.value != fee

  // @audit -high amount == 0 can block the earnSnow function

  if (msg.value == (s_buyFee * amount)) {

  _mint(msg.sender, amount);

  } else {

  i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));

  _mint(msg.sender, amount);

  }

  ​

  @> s_earnTimer = block.timestamp;// update the s_earnTimer

  ​

  emit SnowBought(msg.sender, amount);

  }

  ​

  function earnSnow() external canFramSnow {

  // always revert

  @> if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {

  revert S__Timer();

  }

  _mint(msg.sender, 1);

  ​

  s_earnTimer = block.timestamp;

  }

Risk

No body can use the earnSnowfunction

Likelihood:

• high

Impact:

• high

Proof of Concept

1. Jerry can always call the buySnow with amount = 0 ,and update the s_earnTimer variable.

2. Victory wants to earnSnow,but revert

Recommended Mitigation

remove s_earnTimer = block.timestamp;