Submission Details
Impact:
Likelihood:
Missing require `msg.value` == 0 in `buySnow` for WETH payment
Root
The buySnow() method collects WETH payment from the buyer in the else branch, if the specified msg.value were not set to the correct total amount (s_buyFee * amount). The else branch should also require that msg.value == 0.
Impact
Without the msg.value check in the else branch, the buyer may potentially pay in both ETH and WETH tokens to mint SNOW tokens.
Proof of Concept
function testDoublePayForSnow() public {
uint256 ethAmount = 1 ether;
vm.startPrank(preston);
weth.approve(address(snow), FEE);
snow.buySnow{value: ethAmount}(1);
vm.stopPrank();
assert(weth.balanceOf(address(snow)) == FEE);
console2.log("Snow contract WETH balance: ", weth.balanceOf(address(snow)));
assert(address(snow).balance == ethAmount);
// Snow contract ETH balance should not be a positive value. DOUBLE CHARGED
console2.log("Snow contract ETH balance: ", address(snow).balance);
}
Mitigation
line 86 of Snow.sol
+ require(msg.value == 0, "msg.value != 0");
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.