Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Zero-amount buySnow(0) call can Deny Service of earnSnow()

jufel

Description: The Snow::buySnow() does not validate that amount is non-zero, yet it always updates the global s_earnTimer to block.timestamp. Since earnSnow() checks that 'block.timestamp >= s_earnTimer + 1 weeks', an attacker can call 'buySnow(0)' at zero cost to reset the timer and indefinitely block all users from calling earnSnow() within each 1-week window. The attack is trivial to execute and costs only gas fees

Impact: No check against 'amount == 0' means an attacker can perpetually reset 's_earnTimer', causing 'earnSnow()' to revert for everyone. This attack can be repeated
indefinitely, effectively breaking a core protocol feature. The impact is significant to the token distribution model, though it doesn't directly lead to loss of user funds.

Proof of Concept: Include the following test in the TestSnow.t.sol file:

function testBuySnowZeroAmount() public {
vm.prank(victory);
snow.buySnow(0);
​
vm.prank(ashley);
vm.expectRevert();
snow.earnSnow();
}

Recommended Mitigation: Add zero amount check:

function buySnow(uint256 amount) external payable canFarmSnow {
+ if (amount == 0) {
+ revert S__ZeroValue();
+ }
​
// ...
​
- s_earnTimer = block.timestamp;
​
emit SnowBought(msg.sender, amount);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

buying of snow resets global timer thus affecting earning of free snow

When buySnow is successfully called, the global timer is reset. This inadvertently affects the earning of snow as that particular action also depends on the global timer.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.