🔐 Reentrancy Vulnerability in Snow.collectFee()

📋 Description

🔧 Normal Behavior

The collectFee() function allows the s_collector to collect all WETH and ETH held by the contract. It does this by calling the transfer() function on the WETH token and then sending the native ETH via a low-level call.

🐞 Specific Issue

The contract does not protect the collectFee() function against reentrancy attacks. Because it uses a low-level call to send ETH directly to the s_collector, a malicious contract can exploit this by reentering the collectFee() function (or other vulnerable external functions) during the fallback execution, draining ETH or disrupting the logic.

🚨 Risk

📈 Likelihood

• The s_collector can be a contract, and nothing prevents it from being a malicious one.

• As soon as collectFee() is called and ETH is transferred via call, the fallback function of the recipient contract can reenter the collectFee() function or another vulnerable function.

💥 Impact

• An attacker can recursively call collectFee() to drain ETH from the contract before the function finishes executing.

• It may also interfere with any future logic or upgrade mechanisms that depend on internal state updates happening after the ETH transfer.

🧪 Proof of Concept

Here’s a minimal malicious contract that can exploit the vulnerability if set as the s_collector:

✅ Set s_collector = MaliciousCollector, then call attack() to recursively drain ETH.

🛠️ Recommended Mitigation

✅ Use Reentrancy Protection

1. Import OpenZeppelin’s ReentrancyGuard:

1. Apply nonReentrant to the vulnerable function:

🧱 Optional: Use Checks-Effects-Interactions Pattern

Move ETH transfer logic to the end of the function and update state before external interactions, if applicable.

🛡️ Security Recommendations

• Always protect external ETH transfers with reentrancy guards.

• Favor call with caution and ensure minimal logic is executed after external calls.

• Restrict sensitive roles like s_collector to EOAs or audited contracts.