Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Buying Snow Tokens Incorrectly Resets Weekly Earning Timer

teoslaf

Description

  • The Snow token is designed to allow users to earn one free token per week, or buy tokens at any time during the farming period.

  • The buySnow function incorrectly resets the s_earnTimer variable, which is used to enforce the once-per-week free earning limit. This prevents users from earning free tokens for a week after purchasing tokens, even if they were already eligible to earn.

function buySnow(uint256 amount) external payable canFarmSnow {
if (msg.value == (s_buyFee * amount)) {
_mint(msg.sender, amount);
} else {
i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
_mint(msg.sender, amount);
}
​
@> s_earnTimer = block.timestamp;
​
emit SnowBought(msg.sender, amount);
}

Risk

Likelihood:

  • When someone uses buySnow() function the timer is reset and users who waited 1 week wont be able to claim, even if they were previously eligible to earn free tokens.

  • This occurs on every purchase transaction, affecting all users.

Impact:

  • Users are have to hope that noone is going to purchase the token so they can claim their free snow.

  • The protocol's stated functionality of allowing users to earn free tokens once per week is compromised.

Proof of Concept

  • Add this test in TestSnow.t.sol

function testCantEarnSnow() public {
vm.warp(block.timestamp + 1 weeks);
vm.startPrank(jerry);
weth.approve(address(snow), FEE);
snow.buySnow(1);
vm.stopPrank();
​
assert(weth.balanceOf(address(snow)) == FEE);
assert(snow.balanceOf(jerry) == 1);
​
vm.prank(jerry);
vm.expectRevert();
snow.earnSnow();
}

Recommended Mitigation

  • Don't reset the timer when someone buys snow

function buySnow(uint256 amount) external payable canFarmSnow {
if (msg.value == (s_buyFee * amount)) {
_mint(msg.sender, amount);
} else {
i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
_mint(msg.sender, amount);
}
​
- s_earnTimer = block.timestamp;
​
emit SnowBought(msg.sender, amount);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

buying of snow resets global timer thus affecting earning of free snow

When buySnow is successfully called, the global timer is reset. This inadvertently affects the earning of snow as that particular action also depends on the global timer.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.