Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Users ETH Stuck in the contarct !!

lemrabetmoctar1

Wrong handling of msg.value, Users can get ther ETH stuck in teh contract

Description

  • If user send less or more ETH the contratc should send the eth back to the sender or revert

  • Because of the miss handling of the require msg.value == cost if it is less or more the contract keep it

function buySnow(uint256 amount) external payable canFarmSnow {
//@> if (msg.value == (s_buyFee * amount)) { //@audit-issue: if the user send value > or < cost the ETH will be locked in the contract
_mint(msg.sender, amount);
} else {
i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
_mint(msg.sender, amount);
}
`
s_earnTimer = block.timestamp;
​
emit SnowBought(msg.sender, amount);
}

Risk

Likelihood:

  • anytime user try to bough a token they can face this problem

Impact:

  • Users can loos their ETH forever

Proof of Concept

this is a step by step sinario that show how this bug will effect users and a test using foundry

1- user try to buy a snow token
2- send ETH > cost
3- the ETH will get stuck in teh contract
4- user now will need to pay using weth
​
code:
function test_BuyingWithWrongETH_LocksETH() public {
uint256 cost = FEE;
​
// give user WETH
deal(address(weth), victory, cost);
​
vm.deal(victory, 10 ether);
​
vm.prank(victory);
weth.approve(address(snow), cost);
​
// send MORE ETH than required
// contract eth balance befroe send
console2.log("Contract ETH balance before overpaying:", address(snow).balance);
vm.prank(victory);
snow.buySnow{value: cost + 1}(1);
​
// contract keeps ALL ETH
assertEq(address(snow).balance, cost + 1);
console2.log("Contract ETH balance after overpaying:", address(snow).balance);
}

Recommended Mitigation

You should add require if teh msg.value != cost should revert or having a Refund overpayment automatically

- if (msg.value == (s_buyFee * amount)) {
- _mint(msg.sender, amount);
- }
+ require(msg.value == s_buyFee * amount, "Send exact ETH amount");
+ _mint(msg.sender, amount);
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 4 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!