Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Buying snow token resets free earn timer

hyperion

Root + Impact

Description

  • The snow token should have a recurring free claim once per week, independently of whether users buy tokens or not.

  • The current implementation resets the s_earnTimer if the buySnow function is called.

function buySnow(uint256 amount) external payable canFarmSnow {
if (msg.value == (s_buyFee * amount)) {
_mint(msg.sender, amount);
} else {
i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
_mint(msg.sender, amount);
}
s_earnTimer = block.timestamp; //timer reset here
​
emit SnowBought(msg.sender, amount);
}

Risk

Likelihood:

  • This flow will occur whenever the user buys snow tokens, which is often.

Impact:

  • The user will not be able to claim their free tokens if they want to buy snow and stake more often than once per week in the protocol.

Proof of Concept

  1. Alice calls earnSnow and claims her free snow token, setting s_earnTime to block 1000(as an example).

  2. Two days later, Alice decides she wants to buy more snow tokens and calls buySnow, setting s_earnTime to block 2000.

  3. After one week from block 1000, Alice tries to call earnSnow but gets her tx reverted because now she has to wait until one week from block 2000.

Recommended Mitigation

Remove the s_earnTime set in buySnow.

function buySnow(uint256 amount) external payable canFarmSnow {
if (msg.value == (s_buyFee * amount)) {
_mint(msg.sender, amount);
} else {
i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
_mint(msg.sender, amount);
}
- s_earnTimer = block.timestamp; //delete this line
​
emit SnowBought(msg.sender, amount);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

buying of snow resets global timer thus affecting earning of free snow

When buySnow is successfully called, the global timer is reset. This inadvertently affects the earning of snow as that particular action also depends on the global timer.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.