Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

User's can lose native amounts due to dual payment methods enabled

troglodytsec

Root + Impact

The buySnow() function accepts both native ETH and WETH payments but lacks proper validation to ensure users can only use one payment method per transaction. Leading to native ETH loss.

Description

The expected behavior is to receive ETH or wETH, and process the snow sell. However, by not validating the input, a user could accidentally send both native ETH and WETH in the same transaction, the contract will only process the WETH transfer (via safeTransferFrom) and ignore the native ETH (msg.value). Another scenario would bring the intention of the user to buy an X amount, paying A amount in native and B in wETH.

The user’s native ETH will be permanently lost as it remains in the contract without minting the corresponding tokens.

function buySnow(uint256 amount) external payable canFarmSnow {
@> if (msg.value == (s_buyFee * amount)) {
_mint(msg.sender, amount);
@> } else {
i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
_mint(msg.sender, amount);
}
s_earnTimer = block.timestamp;
emit SnowBought(msg.sender, amount);
}

Risk

Likelihood: MEDIUM

  • This issue could arise mainly from the user misunderstanding the protocol, or,

  • From typing.

Impact:

  • The user would lose any native amount sent.

Proof of Concept

​

Recommended Mitigation

Modify the logic to explicitly restrict payments to one method per transaction:

function buySnow(uint256 amount) external payable canFarmSnow {
uint256 totalCost = s_buyFee * amount;
​
- if(msg.value == s_buyFee * amount){
+ if (msg.value > 0 && msg.value == totalCost) {
_mint(msg.sender, amount);
} else {
i_weth.safeTransferFrom(msg.sender, address(this), totalCost);
_mint(msg.sender, amount);
}
​
s_earnTimer = block.timestamp;
emit SnowBought(msg.sender, amount);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge
11 days ago
yeahchibyke Lead Judge 11 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.