Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: low
Invalid

Unbounded Loop in Snowman.mintSnowman()

xrave110

Root + Impact

Description

  • mintSnowman() loops amount times with no upper bound. Each iteration calls _safeMint() (storage write + callback), emits an event, and increments the counter. For large amounts, this exceeds the block gas limit.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • Unlikely with typical amounts, but possible with large buySnow() purchases which have no cap.

Impact:

  • If a user's balance exceeds the gas-feasible mint count, their claimSnowman() permanently reverts. Funds locked.

Proof of Concept

for (uint256 i = 0; i < amount; i++) { // no upper bound
_safeMint(receiver, s_TokenCounter);
emit SnowmanMinted(receiver, s_TokenCounter);
s_TokenCounter++;
}

Recommended Mitigation


Add a max mint-per-call limit, or use batch minting.

- remove this code
+ add this code
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!