Root + Impact
// @audit Global s_earnTimer variable causes DoS for all users
// The s_earnTimer is a single global variable instead of per-user mapping
uint256 private s_earnTimer;

function earnSnow() external canFarmSnow {
if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
revert S__Timer();
}
_mint(msg.sender, 1);
s_earnTimer = block.timestamp; // @audit This updates timer for ALL users
}

Description

The s_earnTimer variable is declared as a global state variable instead of a mapping(address => uint256). When any user calls earnSnow(), it updates the timer for ALL users, preventing anyone else from earning for 1 week.

Risk

Likelihood:High (5/5) - Any user calling earnSnow() will trigger this issue

Impact:High (5/5) - Prevents all other users from earning tokens for 1 week, effectively breaking the entire farming mechanism

Proof of Concept

Recommended Mitigation

mapping(address => uint256) private s_earnTimer;

function earnSnow() external canFarmSnow {
if (s_earnTimer[msg.sender] != 0 && block.timestamp < (s_earnTimer[msg.sender] + 1 weeks)) {
revert S__Timer();
}
_mint(msg.sender, 1);
s_earnTimer[msg.sender] = block.timestamp;
}