Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Snow.earnSnow mints 1 wei (1e-18 Snow) instead of 1 full token — users receive negligible weekly rewards

fishyyh

Snow.earnSnow mints 1 wei (1e-18 Snow) instead of 1 full token

Impact

Medium Impact

Likelihood

High Likelihood

Root + Impact

Description

  • Snow.earnSnow is intended to reward active users with 1 Snow token per week.

  • The implementation calls _mint(msg.sender, 1). Because Snow inherits the default ERC20 18-decimal precision, 1 represents 1e-18 Snow. Every standard ERC20 wallet and DeFi UI will display this as 0.000000000000000001 Snow. A user would need to call earnSnow 1,000,000,000,000,000,000 times to accumulate 1 visible Snow token.

// src/Snow.sol
function earnSnow() external canFarmSnow {
if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
revert S__Timer();
}
@> _mint(msg.sender, 1); // mints 1 wei, not 1e18
s_earnTimer = block.timestamp;
}

Risk

Likelihood:

  • This affects every user who calls earnSnow — there are no edge cases; the bug triggers on every call.

Impact:

  • Users receive a reward 1e18x smaller than intended, making the weekly earn mechanic economically meaningless.

  • If SnowmanAirdrop treats Snow balance in wei units as NFT count, users also receive far fewer Snowman NFTs than expected.

Proof of Concept

function test_EarnSnow_MintAmount() public {
vm.prank(user);
snow.earnSnow();
assertEq(snow.balanceOf(user), 1); // 1 wei, not 1 token
assertNotEq(snow.balanceOf(user), 1e18); // definitely not 1 Snow
}

Recommended Mitigation

+ uint256 private constant PRECISION = 1e18;
​
function earnSnow() external canFarmSnow {
if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
revert S__Timer();
}
- _mint(msg.sender, 1);
+ _mint(msg.sender, 1 * PRECISION);
s_earnTimer = block.timestamp;
}

Alternatively, override decimals() to return 0 if Snow is intended to be a whole-number token.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 4 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!