Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

`buySnow` — mismatched `msg.value` causes permanent ETH loss AND WETH charge

aiada

Description

  • Normal: buySnow should accept either ETH or WETH, not both.

  • Bug: The if/else only checks exact equality. If msg.value > 0 doesn't match exactly, ETH is lost AND WETH is pulled. No refund mechanism.

if (msg.value == (s_buyFee * amount)) {
_mint(msg.sender, amount); // ETH path
} else {
// Falls here even if msg.value > 0 but wrong amount!
i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
// User loses msg.value AND pays WETH
}

Risk

  • Likelihood: Low-Medium

  • Impact: Medium — User funds permanently locked

Proof of Concept

function testM02_WrongEthAmountLosesFunds() public {
weth.mint(bob, 5e18);
vm.deal(bob, 1 ether);
vm.startPrank(bob);
weth.approve(address(snow), 5e18);
snow.buySnow{value: 1 ether}(1); // wrong amount
vm.stopPrank();
assertEq(address(snow).balance, 1 ether); // ETH lost
assertEq(weth.balanceOf(address(snow)), 5e18); // WETH also charged
}

Recommended Mitigation

+ } else if (msg.value > 0) {
+ revert("Cannot send ETH with WETH payment");
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 18 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!