Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Incorrect timer implementation

hyperion

Root + Impact

Description

  • The timer should be implemented on a per-user basis, allowing every user to claim their free snow tokens once per week, however the current implenenation is a global timer which only allows the fastest user to claim the free tokens.

function earnSnow() external canFarmSnow {
if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
revert S__Timer();
}
_mint(msg.sender, 1);
​
s_earnTimer = block.timestamp; //global timer variable

Risk

Likelihood:

  • Every user will try to claim the free tokens so this is a high likelihood

Impact:

  • Only one user will have access to the free tokens every week, the rest won't be able to participate in the protocol's initiative.

Proof of Concept

  1. Alice calls earnSnow, setting s_earnTimer to the current timestamp

  2. Bob tries to call earnSnow moments later

  3. Bob's tx reverts because of Alice's previous set of the global timer

Recommended Mitigation

Replace the global timer with a mapping that keeps track of each user's claims.

- uint256 private s_earnTimer;
+ mapping(address => uint256) private s_earnTimer;
​
...
​
function earnSnow() external canFarmSnow {
if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
revert S__Timer();
}
_mint(msg.sender, 1);
​
- s_earnTimer = block.timestamp;
+ s_earnTimer[msg.sender] = block.timestamp;
}
​
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge
5 months ago
yeahchibyke Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.