Snowman Merkle Airdrop

First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Submission Details
Impact: low
Likelihood: high
Invalid

Incorrect `s_buyFee` scaling allows users getting overcharged on Minting Snow tokens

# Incorrect `s_buyFee` scaling allows users getting overcharged on Minting Snow tokens
## Description
* Normally, `s_buyFee` should represent the fee per Snow token **in wei**, e.g., `0.01 ether = 10**16`.
* However, in the `Snow` contract constructor, `s_buyFee` is mistakenly multiplied by `PRECISION` (10¹⁸), leading to a fee that is **18 decimal places too large**. This causes the ETH requirement in `buySnow()` to be **unreasonably high**, resulting in failed transactions or fallback to WETH unintentionally.
```solidity
constructor(address _weth, uint256 _buyFee, address _collector) ERC20("Snow", "S") Ownable(msg.sender) {
...
// @audit Mishandling of Eth, Poor Precision
@> s_buyFee = _buyFee * PRECISION;
...
}
```
## Risk
**Likelihood**:
* This issue **always occurs** if `_buyFee` is provided in wei (as is standard), and the developer multiplies it by `PRECISION`.
* It is highly likely to affect all deployments and user interactions unless specifically corrected.
**Impact**:
* Users will be required to send an unreasonably large amount of ETH (e.g., 10³⁴ wei) to mint even 1 token.
## Proof of Concept
The following example shows how PRECISION will inflate the Snow token price.
```solidity
// Deployer passes 0.01 ether as the _buyFee
uint256 _buyFee = 10**16; // 0.01 ether
// Contract sets s_buyFee = 10^16 * 10^18 = 10^34
// User tries to buy 1 Snow token by sending 0.01 ether
snow.buySnow{value: 10**16}(1);
// Fails: msg.value != s_buyFee * amount
```
## Recommended Mitigation
Omit unnecessary PRECISION.
```diff
- s_buyFee = _buyFee * PRECISION;
+ s_buyFee = _buyFee;
```
Updates

Lead Judging Commences

yeahchibyke Lead Judge 15 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.