Root + Impact

Unrestricted Zero-Amount Purchases Waste Gas and Emit Invalid Events

Description

The Snow.sol::buySnowfunction allows users to pass amount = 0, which causes the function to:

• Accept the transaction

• Mint zero tokens

• Update s_earnTimer

• Emit a SnowBought event

Since no real action occurs (no mint, no fee, no transfer), this results in meaningless computation and gas usage, and can spam event logs and pollute analytics systems.

Risk

Likelihood:

• Anyone can call this function with amount = 0, either accidentally or maliciously.

Impact:

• Wastes gas

Proof of Concept

Recommended Mitigation

Add a validation check at the beginning of the buySnow function:

This prevents unintended or abusive use of the function and ensures that only meaningful transactions are processed.