Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

SnowmanMinted event is emitted per-token with misleading parameter

wh4t54u53rn4m3

Root + Impact

Description

  • Event name/param (numberOfSnowman) implies it reports a total count minted.

  • It's actually emitted once per loop iteration with the raw tokenId, not a count.

event SnowmanMinted(address indexed receiver, uint256 indexed numberOfSnowman);
...
emit SnowmanMinted(receiver, s_TokenCounter); // @> this is a tokenId, not a "number of Snowman"

Risk

Likelihood:

  • Off-chain indexers/frontends relying on the param name could misreport minted quantities.

Impact:

  • Off-chain indexers, subgraphs, or frontends that read numberOfSnowman expecting a total minted count will display/store tokenId values instead — incorrect analytics/UI, not a fund-loss issue.

  • Minting amount = 5 emits 5 separate events with values like 0, 1, 2, 3, 4 instead of one event showing 5.

Proof of Concept

+ vm.prank(user);
+ vm.recordLogs();
+ snowman.mintSnowman(user, 3);
+ // 3 separate SnowmanMinted events fire, with numberOfSnowman = 0, 1, 2 (tokenIds)
+ // NOT a single event with numberOfSnowman = 3 (the actual amount minted)

Recommended Mitigation

- emit SnowmanMinted(receiver, s_TokenCounter);
+ // emit once after the loop with the actual amount minted
+ emit SnowmanMinted(receiver, amount);
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!