Submission Details
Impact:
Likelihood:
claimSnowman() Reads balanceOf Multiple Times (TOCTOU)
Root + Impact
Description
i_snow.balanceOf(receiver)is called on line 76 (zero check) and again on line 84 (actual amount). Additionally,getMessageHash()reads the balance two more times (lines 113, 117). Total: 4 reads of the same value in a single claim flow.
// Root cause in the codebase with @> marks to highlight the relevant section
Risk
Likelihood:
Low with current standard ERC20, but any token with transfer hooks could change balance between reads.
Impact:
Merkle proof could be computed on a different amount than what gets transferred.
Proof of Concept
if (i_snow.balanceOf(receiver) == 0) { // read #1
revert SA__ZeroAmount();
}
// getMessageHash(receiver) reads balanceOf twice more
uint256 amount = i_snow.balanceOf(receiver); // read #4
Recommended Mitigation
+ uint256 amount = i_snow.balanceOf(receiver);
+ if (amount == 0) revert SA__ZeroAmount();
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.