Submission Details
Impact:
Likelihood:
L-2 — `collectFee` uses unchecked ERC20 transfer
Root + Impact
collectFee calls i_weth.transfer(...) and ignores the returned boolean, unlike buySnow which uses SafeERC20. A token that returns false without reverting silently loses fees.
Description
// src/Snow.sol
101: function collectFee() external onlyCollector {
102: uint256 collection = i_weth.balanceOf(address(this));
@>103: i_weth.transfer(s_collector, collection); // return value ignored
104:
105: (bool collected,) = payable(s_collector).call{value: address(this).balance}("");
106: require(collected, "Fee collection failed!!!");
Risk
Likelihood: Low — depends on the specific WETH/token implementation.
Impact: Low — fee transfer may fail silently; funds remain in the contract.
Proof of Concept
// Illustrative: a token whose transfer returns false without reverting
contract FalseReturnToken is ERC20 {
function transfer(address, uint256) public pure override returns (bool) {
return false;
}
}
// collectFee() would continue past the unchecked transfer and leave fees stranded.
Recommended Mitigation
- i_weth.transfer(s_collector, collection);
+ i_weth.safeTransfer(s_collector, collection);
Snow already declares using SafeERC20 for IERC20;.
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.