Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

`Snow::buySnow` pulls the full WETH fee even when the caller also sent ETH, keeping both payments

furkanumut

Root + Impact

Description

buySnow accepts payment either in native ETH (exact s_buyFee * amount) or in WETH (pulled via transferFrom). However, the rail selection is a strict equality check on msg.value, so any non-exact ETH amount silently falls into the WETH branch, which charges the full WETH fee and keeps the attached ETH — with no refund path.

// File: src/Snow.sol — Lines 79–85
function buySnow(uint256 amount) external payable canFarmSnow {
if (msg.value == (s_buyFee * amount)) {
_mint(msg.sender, amount);
} else {
@> i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount)); // full WETH fee pulled...
@> _mint(msg.sender, amount); // ...while any attached msg.value ETH is also kept
}

A user who intends to pay in WETH but accidentally attaches ETH (a common wallet/UX mistake), or who overpays the ETH fee by even 1 wei, is charged on both rails: the contract pulls s_buyFee * amount WETH from them and retains every wei of the attached ETH, which collectFee later sweeps to the fee collector. There is no branch that refunds or credits the excess, so the overpayment is a permanent, unrecoverable loss for the buyer.

Risk

Likelihood:

  • Any buyer who attaches a non-exact msg.value while holding an active WETH approval — e.g. intending the WETH rail and leaving ETH on the call, or miscomputing the exact fee.

  • No attacker needed; ordinary user error triggers it.

Impact:

  • Direct, unrecoverable loss of all ETH attached to a non-exact-payment buy (demonstrated: 5 WETH charged plus 1 ETH kept for a single 1-wei purchase).

  • Lost funds accrue to the fee collector via collectFee — users fund the protocol's fee pot through the ambiguity.

Proof of Concept

function test_PoC_DoubleChargeEthAndWeth() public {
MockWETH weth2 = new MockWETH();
address collector = makeAddr("collector");
Snow snow2 = new Snow(address(weth2), 5, collector); // same params as the deploy script (FEE = 5)
address carol = makeAddr("carol");
​
weth2.mint(carol, 100e18);
vm.startPrank(carol);
weth2.approve(address(snow2), type(uint256).max);
vm.deal(carol, 1 ether);
snow2.buySnow{value: 1 ether}(1); // fee for 1 wei of Snow = 5e18; msg.value 1e18 != 5e18
vm.stopPrank();
​
assertEq(snow2.balanceOf(carol), 1); // she gets her 1 wei of Snow...
assertEq(weth2.balanceOf(carol), 95e18); // ...charged 5 WETH...
assertEq(address(snow2).balance, 1 ether); // ...AND her 1 ETH was kept too
}

Run: add the test to test/TestSnowmanAirdrop.t.sol (it imports MockWETH already), then forge test --match-test test_PoC_DoubleChargeEthAndWeth -vv

Output (actual run):

[PASS] test_PoC_DoubleChargeEthAndWeth() (gas: 2553725)
Logs:
FC-0006: user paid 5 WETH and 1 ETH for one purchase; ETH kept: 1000000000000000000

Recommended Mitigation

Make the rail choice explicit and reject mixed or incorrect payment.

function buySnow(uint256 amount) external payable canFarmSnow {
+ if (amount == 0) { revert S__ZeroValue(); }
if (msg.value == (s_buyFee * amount)) {
_mint(msg.sender, amount);
- } else {
+ } else if (msg.value == 0) {
i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
_mint(msg.sender, amount);
+ } else {
+ revert S__IncorrectPayment();
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 19 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!