Submission Details
Impact:
Likelihood:
### [L-5] Unnecessary state Updation Before performing critical operations in ```SnowmanAirdrop::claimSnowman``` Function.
[L-5] Unnecessary state Updation Before performing critical operations in SnowmanAirdrop::claimSnowman Function.
Description
Before performing critical operations such as minting nfts in SnowmanAirdrop::claimSnowman Function.
If somehow nft minting gets failed ,the s_hasClaimedSnowman state gets updated to true
even though operation was not successfull.
Impact:
1.User will lost his earned snow tokens beacuse it got transferred.
2.Due to state updation,user wont be able to call the claimsnowman function.
3.user loses his ability to claim its snow token back and nft both.
Proof of Concept
1.user bob calls ```claimSnowman``` function with receiver(alice).
2.Alice gets verified to claim bob's airdrop,tokens get transferred.
3.The ```s_hasClaimedSnowman[receiver] = true``` state get updated to true.
4.But somehow nft minting gets failed,alice loses his tokens and nft both
as alice gets prevented from calling the claimsnowman function.
Recommended Mitigation
Update s_hasClaimedSnowman[receiver] state on successfull completion of all
critcial operation
function claimSnowman(
address receiver,
bytes32[] calldata merkleProof,
uint8 v,
bytes32 r,
bytes32 s
) external nonReentrant {
if (receiver == address(0)) {
revert SA__ZeroAddress();
}
if (i_snow.balanceOf(receiver) == 0) {
revert SA__ZeroAmount();
}
if (!_isValidSignature(receiver, getMessageHash(receiver), v, r, s)) {
revert SA__InvalidSignature();
}
uint256 amount = i_snow.balanceOf(receiver);
bytes32 leaf = keccak256(
bytes.concat(keccak256(abi.encode(receiver, amount)))
);
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert SA__InvalidProof();
}
i_snow.safeTransferFrom(receiver, address(this), amount);
-s_hasClaimedSnowman[receiver] = true;
i_snowman.mintSnowman(receiver, amount);
+s_hasClaimedSnowman[receiver] = true;
emit SnowmanClaimedSuccessfully(receiver, amount)
Rewards breakdown
nSLOC
215This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.