Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

[H-02] `buySnow` Logic Discards `msg.value` and Pulls Extra WETH

teejay4life

Description:

The if/else logic in buySnow is flawed. If the user sends an amount of ETH that does not exactly match the fee, the contract enters the else block.

} else {
i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
_mint(msg.sender, amount);
}

Impact:

If a user sends $0.5$ ETH when the fee is $1$ ETH, the if fails. The contract then attempts to pull $1$ full WETH from the user via safeTransferFrom. The original $0.5$ ETH sent remains stuck in the contract, effectively double-charging the user or losing their funds.

PoC

Pase in TestSnow.t.sol file

function testStuckedETH() public {
address me = makeAddr("me");
​
vm.deal(me, 100 ether);
deal(address(weth), me, 100e18);
​
uint256 prevETHBal = me.balance;
uint256 prevWETHBal = weth.balanceOf(me);
​
vm.startPrank(me);
weth.approve(address(snow), FEE);
snow.buySnow{value: FEE + 1}(1);
vm.stopPrank();
​
assertEq(prevETHBal, (FEE + 1) + me.balance, "Money Stucked");
assertEq(prevWETHBal, (FEE * 1) + weth.balanceOf(me), "collected WETH");
}

Recommended Mitigation:

Ensure the function only accepts one form of payment at a time or explicitly refunds excess msg.value.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 7 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!