Root + Impact

Description

The claimSnowman function currently uses:

This means the amount of tokens the user is claiming is dynamically calculated based on the current balance of the i_snow token at the time of calling the claimSnowman function.

The problem is that this relies on the live balance, not on a snapshot taken at the time the Merkle tree was generated.

Risk

Likelihood: High

After the snapshot users may receive more tokens.

When they call claimSnowman, the function uses their current balance, which includes tokens received after the snapshot, allowing them to claim more NFTs than they were originally entitled to.

Impact:

• Claim more NFTs

  
  

Proof of Concept

Exploit Example:

This is not what was intended, because the amount should be based on their balance at the snapshot time when the Merkle tree was generated, not their current live balance.

Recommended Mitigation

Add uint256 amount in the function as a parameter, this way we make sure that the amount being claimed is fixed and verified by the Merkle proof.

This ensure that the amount can't be manipulated by manipulating their currrent token balance.