Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

[HIGH] Global Farming Timer Prevents Fair Snow Distribution

mlvphani2582

Root + Impact

Description

  • The contract uses a single global variable:

  • Explain the specific issue or problem in one or more sentences

uint256 private s_earnTimer;
​
​
In earnSnow():
​
​
if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
revert S__Timer();
}

Since s_earnTimer is shared across all users, once one user calls earnSnow(), all other users must wait one week.

This enables a griefing attack where one address repeatedly calls earnSnow() weekly to prevent others from earning tokens.

Impact:

Denial of service for all users except one per week.

  • Only one user can farm per week

Others are permanently blocked

  • Breaks fairness of distribution

  • Farming feature becomes unusable

Proof of Concept

Attacker calls earnSnow() at time T.
​
s_earnTimer = T.
​
Any other user calling within 1 week reverts.
​
This repeats indefinitely.

Recommended Mitigation

Use per-user timers:

mapping(address => uint256) private s_earnTimer;
​
if (
s_earnTimer[msg.sender] != 0 &&
block.timestamp < s_earnTimer[msg.sender] + 1 weeks
) {
revert S__Timer();
}
​
s_earnTimer[msg.sender] = block.timestamp;
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!