Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Missing Maximum Supply Limit Allows Infinite NFT Minting

comfortnurse021

A standard NFT collection should have a defined maximum supply to create digital scarcity and maintain token value. This is typically implemented through a supply cap or minting limits that prevent the total number of tokens from exceeding a predetermined maximum.

Specific Issue

The Snowman contract lacks any maximum supply limit, allowing the s_TokenCounter to increment indefinitely. While Solidity's integer overflow protection in version 0.8.x prevents counter overflow, the contract can still mint an unlimited number of tokens, which:

root cause: https://github.com/CodeHawks-Contests/2025-06-snowman-merkle-airdrop/blob/b63f391444e69240f176a14a577c78cb85e4cf71/src/Snowman.sol#L42

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:high,The combination of high potential profit and low execution difficulty creates a strong economic incentive.

Every NFT marketplace, analytics tool, and blockchain explorer automatically reveals total supply metrics

Impact:

Complete Destruction of Digital Scarcity and Economic Value

Irreversible Brand and Reputation Damage

Proof of Concept

​
function test_MaxSupplyNotEnforced() public {
address owner = snowman.owner();
vm.startPrank(owner);
Mint up to what should be "max supply"
uint256 supposedMax = 10000;
snowman.mintSnowman(owner, supposedMax);
uint256 supplyAfter10k = snowman.getTokenCounter();
assertEq(supplyAfter10k, supposedMax);
Continue minting beyond any reasonable limit
This should fail but doesn't
snowman.mintSnowman(owner, 50000);
uint256 supplyAfter60k = snowman.getTokenCounter();
assertEq(supplyAfter60k, 60000); Supply keeps growing
Mint another arbitrary amount
snowman.mintSnowman(owner, 1000000);
uint256 finalSupply = snowman.getTokenCounter();
assertEq(finalSupply, 1060000); Infinite growth possible
vm.stopPrank();
The collection now has 1,060,000 tokens instead of expected 10,000
Rarity and value are completely destroyed
}

Recommended Mitigation

- s_TokenCounter++;
+ require(s_TokenCounter + amount <= MAX_SUPPLY, "Exceeds maximum supply");
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 4 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!