Submission Details
Impact:
Likelihood:
Any user can get 1 NFT before staking process (s_earnTimer parameter has not initialized)
Global Cooldown Timer Bypass in earnSnow function
Description
The
earnSnowfunction is designed to allow users to earn 1 Snow token once per week. Because of not setting of s_earnTimer parameter,attacker is able to get 1 NFT without doing staking.
// if s_earnTimer is zero,able to mint,s_earnTimer has not initialized
if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
revert S__Timer();
}
_mint(msg.sender, 1);
Risk
Likelihood:
The exploit is highly likely in real-world conditions due to the fully public access to the
earnSnow()function, predictable default state (s_earnTimer == 0)
Impact:
Anyone able to get 1 NFT without staking
Proof of Concept
function test_GlobalCooldownBypass() public {
vm.prank(user1);
snow.earnSnow(); // Works (s_earnTimer == 0)
assertEq(snow.balanceOf(user1), 1); // there is no time check.
}
Recommended Mitigation
+Replace the single s_earnTimer variable with a per-user mapping
Rewards breakdown
nSLOC
215This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.