Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Incorrect Payment Validation Allows Users to Pay WETH While Sending Unintended ETH

livelystar340

Description

  • Normal behavior should allow the user to pay using either ETH or WETH.

Risk

Likelihood:

  • Medium

    • buySnow() is publicly accessible.

    • No privileged role is required.

    • The issue occurs whenever msg.value is nonzero but does not exactly equal the required ETH payment.

    • The contract does not refund the excess ETH or reject the transaction.

Impact:

  • The buySnow() function accepts any msg.value that does not exactly equal the required fee and then proceeds with the WETH payment path.

    Consequently, a user can send ETH together with a WETH payment, causing the contract to retain the unintended ETH while also transferring the required WETH from the user.

Proof of Concept

function testBuySnowAcceptsUnexpectedETHWithWETHPayment() public {
uint256 amount = 1;
​
uint256 ethSent = 1 ether;
​
vm.deal(user, ethSent);
​
vm.startPrank(user);
​
weth.approve(address(snow), type(uint256).max);
​
uint256 ethBefore = address(snow).balance;
​
snow.buySnow{value: ethSent}(amount);
​
vm.stopPrank();
​
assertEq(
address(snow).balance,
ethBefore + ethSent
);
}

Recommended Mitigation

if (msg.value == (s_buyFee * amount)) {
_mint(msg.sender, amount);
} else {
i_weth.safeTransferFrom(
msg.sender,
address(this),
(s_buyFee * amount)
);
_mint(msg.sender, amount);
}- remove this code
+ add this code-
if (msg.value == (s_buyFee * amount)) {
- _mint(msg.sender, amount);
- } else {
+ if (msg.value == (s_buyFee * amount)) {
+ _mint(msg.sender, amount);
+ } else if (msg.value == 0) {
i_weth.safeTransferFrom(
msg.sender,
address(this),
(s_buyFee * amount)
);
_mint(msg.sender, amount);
+ } else {
+ revert S__InvalidPayment();
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!