Root + Impact

Description

The earnSnow() function is designed to allow users to mint 1 SNOW token once every week. It uses a global timer s_earnTimer to enforce the cooldown period.

However, the use of a global cooldown across all users introduces a first-come-first-serve race condition, where the first user to call the function after the cooldown period can claim the reward, while all others will revert. This creates a frontrunning vector, enabling malicious actors or bots to consistently claim the weekly reward.

Risk

Likelihood:

• This will occur every time the cooldown period expires, as the function is globally accessible to anyone.

• Users monitoring the blockchain can predict when the timer resets and preemptively send high-gas transactions.

Impact:

• Only one user can successfully mint the SNOW token per week, leading to unfair distribution.

• Honest users may waste gas fees on reverted transactions, resulting in economic loss and frustration.

Proof of Concept

Recommended Mitigation

Use a per-user cooldown mechanism instead of a global timer:

Additionally, declare:

This ensures fair distribution and prevents frontrunning.