Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Snowman::mintSnowman` updates state after the external `_safeMint` call (CEI)

rayair

Root + Impact

Description

  • mintSnowman increments s_TokenCounter after _safeMint, which performs an external onERC721Received callback.

  • This violates Checks-Effects-Interactions; it is currently mitigated only because ERC721 reverts on a duplicate token id, but the ordering is fragile.

_safeMint(receiver, s_TokenCounter); // external callback happens here
emit SnowmanMinted(receiver, s_TokenCounter);
@> s_TokenCounter++; // state updated AFTER the external call
// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • Occurs on every mint to a contract receiver that implements onERC721Received.

Impact:

  • Reentrancy-prone ordering; safe today only by accident of ERC721's duplicate-id check.

Proof of Concept

```text
Static (aderyn / Slither reentrancy-events): state write after external call in mintSnowman.
```

Recommended Mitigation

```diff
- _safeMint(receiver, s_TokenCounter);
- emit SnowmanMinted(receiver, s_TokenCounter);
- s_TokenCounter++;
+ uint256 tokenId = s_TokenCounter;
+ s_TokenCounter++; // effects before interaction
+ _safeMint(receiver, tokenId);
+ emit SnowmanMinted(receiver, tokenId);
```
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!