Root + Impact- The mintSnowman() function allows minting of arbitrary amounts of NFTs in a single transaction without enforcing a maximum limit. In extreme cases, this could lead to out-of-gas failures and denial-of-service (DoS) for large claims, especially in loops.

Description

• Normally, mintSnowman() accepts a receiver and a uint256 amount, then mints that many NFTs in a loop to the recipient.

• However, without any restriction or gas-efficiency cap on amount, users can pass very large values. This could cause transactions to fail due to gas limits, effectively preventing valid NFT claims if used carelessly or maliciously.

Risk

Likelihood:

• Reason 1: This will occur when a user or attacker submits a claimSnowman() with a very high amount value.

• Reason 2: The gas cost per NFT scales linearly. A higher claim size leads to a higher risk of out-of-gas errors, especially on chains with lower block gas limits.

Impact:

• Impact 1: DoS — genuine users might fail to claim NFTs because their transactions always revert due to excessive loop gas usage.

• Impact 2: Potential griefing vector or chain bloat if miners intentionally include huge mint loops.

Proof of Concept- The normal behavior of claimSnowman() is to mint one Snowman NFT for every 10 Snow tokens by looping amount / 10 times. However, if a user has a large number of tokens (e.g., 100,000), the loop inside mintSnowman() will execute 10,000 times, which can exceed the block gas limit. This causes the transaction to revert, effectively preventing high-volume users from claiming their NFTs and resulting in a denial of service for legitimate claims.

Recommended Mitigation- To avoid out-of-gas errors and potential DoS in mintSnowman(), enforce a hard cap on how many NFTs can be minted in a single transaction. This ensures even large claimers can redeem in batches, without exhausting gas or blocking future claims.

Set a maximum allowed amount (e.g., 100), and revert if the input exceeds this.

Define the custom error for clarity and gas effeciency: error SM__MintTooLarge();