Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Submission Details
Severity: low
Valid

Global DoS in `earnSnow` due to shared state variable `s_earnTimer`

kagnite

Root + Impact

Description

  • Normally, earnSnow() should let each user independently claim 1 Snow token once per week, with the cooldown tracked per user.

  • Instead, the cooldown is tracked in a single global variable s_earnTimer shared by all users, so any single call resets the cooldown for the entire protocol.

// >>> VARIABLES
uint256 private s_earnTimer; // @> shared across ALL users instead of per-address
// ...
function earnSnow() external canFarmSnow {
if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
revert S__Timer();
}
_mint(msg.sender, 1);
s_earnTimer = block.timestamp; // @> updates the timer for ALL users, not just msg.sender
}

Risk

Likelihood:

  • Any user calls earnSnow() (or buySnow(), which also updates s_earnTimer) shortly before another user's intended claim, resetting the shared cooldown.

  • An attacker automates a call to earnSnow() every ~6 days 23 hours, keeping the global timer perpetually refreshed at zero cost.
    Impact:

  • All other users are permanently blocked from claiming via earnSnow(), reverting with S__Timer().

  • The free-farming feature becomes entirely unusable for the protocol, at no cost to the attacker.

Proof of Concept

The test below simulates two independent users interacting with the contract. The attacker calls earnSnow() once, 6 days into the cooldown window, which overwrites the single global s_earnTimer. One day later — a full 7 days after the victim's own (never-executed) starting point — the victim tries to call earnSnow() for the first time and is unexpectedly reverted, because the shared timer was reset by the attacker's unrelated call. This demonstrates that the cooldown is enforced against the wrong reference point (a global variable) instead of per-address state, and that any single user can indefinitely deny the feature to everyone else.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
import "forge-std/Test.sol";
import "../src/Snow.sol";
import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
contract MockWETH is ERC20 {
constructor() ERC20("WETH", "WETH") {}
}
contract SnowDoSTest is Test {
Snow public snow;
MockWETH public weth;
address public attacker = address(0x1337);
address public victim = address(0x9999);
address public collector = address(0x8888);
function setUp() public {
weth = new MockWETH();
snow = new Snow(address(weth), 1, collector);
}
function test_Exploit_TimerDoS() public {
vm.warp(block.timestamp + 6 days);
// Attacker claims free token, resetting the global timer at zero cost
vm.startPrank(attacker);
snow.earnSnow();
vm.stopPrank();
vm.warp(block.timestamp + 1 days);
// Victim attempts to claim after a full week but gets DoS'd
vm.startPrank(victim);
vm.expectRevert(Snow.S__Timer.selector);
snow.earnSnow();
vm.stopPrank();
}
}

Recommended Mitigation

Replace the single uint256 s_earnTimer with a mapping(address => uint256), and update every read/write of the timer (in both earnSnow() and buySnow()) to key off msg.sender. This isolates each user's cooldown so that one user's activity can never affect another user's ability to claim, closing the DoS vector while preserving the original 1-week-per-user cooldown logic.

// >>> VARIABLES
address private s_collector;
- uint256 private s_earnTimer;
+ mapping(address => uint256) private s_earnTimer;
uint256 public s_buyFee;
uint256 private immutable i_farmingOver;
// in buySnow()
- s_earnTimer = block.timestamp;
+ s_earnTimer[msg.sender] = block.timestamp;
emit SnowBought(msg.sender, amount);
function earnSnow() external canFarmSnow {
- if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
+ if (s_earnTimer[msg.sender] != 0 && block.timestamp < (s_earnTimer[msg.sender] + 1 weeks)) {
revert S__Timer();
}
_mint(msg.sender, 1);
- s_earnTimer = block.timestamp;
+ s_earnTimer[msg.sender] = block.timestamp;
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[L-02] Global Timer Reset in Snow::buySnow Denies Free Claims for All Users

## Description: The `Snow::buySnow` function contains a critical flaw where it resets a global timer `(s_earnTimer)` to the current block timestamp on every invocation. This timer controls eligibility for free token claims via `Snow::earnSnow()`, which requires 1 week to pass since the last timer reset. As a result: Any token purchase `(via buySnow)` blocks all free claims for all users for 7 days Malicious actors can permanently suppress free claims with micro-transactions Contradicts protocol documentation promising **"free weekly claims per user"** ## Impact: * **Complete Denial-of-Service:** Free claim mechanism becomes unusable * **Broken Protocol Incentives:** Undermines core user acquisition strategy * **Economic Damage:** Eliminates promised free distribution channel * **Reputation Harm:** Users perceive protocol as dishonest ```solidity function buySnow(uint256 amount) external payable canFarmSnow { if (msg.value == (s_buyFee * amount)) { _mint(msg.sender, amount); } else { i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount)); _mint(msg.sender, amount); } @> s_earnTimer = block.timestamp; emit SnowBought(msg.sender, amount); } ``` ## Risk **Likelihood**: • Triggered by normal protocol usage (any purchase) • Requires only one transaction every 7 days to maintain blockage • Incentivized attack (low-cost disruption) **Impact**: • Permanent suppression of core protocol feature • Loss of user trust and adoption • Violates documented tokenomics ## Proof of Concept **Attack Scenario:** Permanent Free Claim Suppression * Attacker calls **buySnow(1)** with minimum payment * **s\_earnTimer** sets to current timestamp (T0) * All **earnSnow()** calls revert for **next 7 days** * On day 6, attacker repeats **buySnow(1)** * New timer reset (T1 = T0+6 days) * Free claims blocked until **T1+7 days (total 13 days)** * Repeat step **4 every 6 days → permanent blockage** **Test Case:** ```solidity // Day 0: Deploy contract snow = new Snow(...); // s_earnTimer = 0 // UserA claims successfully snow.earnSnow(); // Success (first claim always allowed) // Day 1: UserB buys 1 token snow.buySnow(1); // Resets global timer to day 1 // Day 2: UserA attempts claim snow.earnSnow(); // Reverts! Requires day 1+7 = day 8 // Day 7: UserC buys 1 token (day 7 < day 1+7) snow.buySnow(1); // Resets timer to day 7 // Day 8: UserA retries snow.earnSnow(); // Still reverts! Now requires day 7+7 = day 14 ``` ## Recommended Mitigation **Step 1:** Remove Global Timer Reset from `buySnow` ```diff function buySnow(uint256 amount) external payable canFarmSnow { // ... existing payment logic ... - s_earnTimer = block.timestamp; emit SnowBought(msg.sender, amount); } ``` **Step 2:** Implement Per-User Timer in `earnSnow` ```solidity // Add new state variable mapping(address => uint256) private s_lastClaimTime; function earnSnow() external canFarmSnow { // Check per-user timer instead of global if (s_lastClaimTime[msg.sender] != 0 && block.timestamp < s_lastClaimTime[msg.sender] + 1 weeks ) { revert S__Timer(); } _mint(msg.sender, 1); s_lastClaimTime[msg.sender] = block.timestamp; // Update user-specific timer emit SnowEarned(msg.sender, 1); // Add missing event } ``` **Step 3:** Initialize First Claim (Constructor) ```solidity constructor(...) { // Initialize with current timestamp to prevent immediate claims s_lastClaimTime[address(0)] = block.timestamp; } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!