Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

DoS in mintSnowman function

hyperion

Root + Impact

Description

  • Users should be able to stake and mint large amounts of snow tokens if they choose

  • The current implementation can get very expensive leading to a DoS due to the loop size

function mintSnowman(address receiver, uint256 amount) external {
for (uint256 i = 0; i < amount; i++) { //this loop will become VERY expensive.
_safeMint(receiver, s_TokenCounter);
​
emit SnowmanMinted(receiver, s_TokenCounter);
​
s_TokenCounter++;
}
}

Risk

Likelihood:

  • Any user that wants to mint a snowman will likely face large gas fees. 1 ETH worth of snow tokens will result in 1e18 loop iterations.

Impact:

  • Users will face a DoS, unable to mint a snowman NFT.

Proof of Concept

  1. Alice calls buySnow with msg.value=1 ETH

  2. Alice calls claimSnowman for her allowed stake of 1e18

  3. Her tx gas price is huge and Alice cannot pay it and is unable to use the protocol.

Recommended Mitigation

Encode the value of each NFT in the metadata rather than having a separate NFT for each snow token staked.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.