Root + Impact

Description

Normal behavior
When buying Snow tokens, the buyer should pay the token price plus a fee, where the fee is either:

• a fixed amount added to the purchase, or

• a rate applied to the purchase amount and scaled by PRECISION.

In buySnow, s_buyFee is stored as _buyFee * PRECISION, but later used as a raw multiplier: s_buyFee * amount.
This mixes fee semantics (fixed vs rate) and precision handling, resulting in incorrect fee calculation. The buyer either massively overpays or the logic becomes inconsistent with the intended design.

Risk

Likelihood:

• Occurs on every buySnow call due to deterministic fee miscalculation

• Triggered regardless of whether ETH or WETH is used

Impact:

• Buyers pay an unintended and potentially extreme fee

Proof of Concept

Recommended Mitigation

Clarify fee semantics and apply correct arithmetic.

Option 1: Fixed fee

Option 2: Percentage fee