Root + Impact

Description

• The Snow token is intended to be minted only during a fixed farming period and permanently disabled after the farming window expires.

• However, the canFarmSnow modifier contains an incorrect timestamp comparison, which allows Snow minting logic to be executed beyond the intended farming deadline.

Risk

Likelihood:

• The issue deterministically occurs once the farming duration has elapsed

• All functions guarded by canFarmSnow are affected

Impact:

• Snow tokens can continue to be minted indefinitely

• The token’s monetary policy and supply assumptions are violated

Proof of Concept

Scenario

The Snow token is designed to be minted only during a fixed farming period of 12 weeks after deployment.
Once the farming period ends, all minting-related functions (buySnow and earnSnow) are expected to permanently revert.

However, due to an incorrect timestamp comparison in the canFarmSnow modifier, Snow minting remains possible after the farming period has ended.

Step-by-Step Attack Flow

The Snow contract is deployed at time T0.

The farming end timestamp is set as:

Time progresses beyond the farming deadline (block.timestamp > i_farmingOver).

A user calls earnSnow() or buySnow().

The canFarmSnow modifier does not prevent execution, and Snow tokens are minted successfully.

Recommended Mitigation

Or refactor the modifier to more clearly reflect its intended semantics.