Submission Details
Impact:
Likelihood:
No Upper Limit on 'amount' in 'buySnow()'
Description: There is no restriction on the amount parameter passed to 'buySnow()'.
Impact: Users can mint massive amounts of Snow tokens if they can pay the corresponding fee, risking inflation.
Recommended Mitigation: Add a limit:
+ uint256 constant MAX_BUY_AMOUNT = 1000;
function buySnow(uint256 amount) external payable canFarmSnow {
+ require(amount <= MAX_BUY_AMOUNT, "Amount too high");
// ...
}
Rewards breakdown
nSLOC
215This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.