Root + Impact

## Description
In `Snow.sol`, the free token earning mechanism is governed by a single global storage variable `uint256 private
s_earnTimer;` instead of a per-user tracking mapping (`mapping(address => uint256)`).

Furthermore, in `Snow::buySnow()`, the contract resets `s_earnTimer = block.timestamp;` whenever any user
purchases tokens.

This directly violates the protocol design specified in `README.md`:
> *"The Snow token can either be earned for free once a week, or bought at anytime, up until during the
::FARMING_DURATION is over."*

Because `s_earnTimer` is global:
1. When any user calls `earnSnow()`, all other users across the entire network are locked out from earning free
tokens for 1 week.
2. Whenever any user calls `buySnow()`, the 1-week lockout timer is reset to the current timestamp, indefinitely
starving all users from ever being able to earn free tokens.

```solidity
// Root cause in the codebase with @> marks to highlight the relevant section:
// File: src/Snow.sol

    // >>> VARIABLES
@>  uint256 private s_earnTimer;

    function buySnow(uint256 amount) external payable canFarmSnow {
        if (msg.value == (s_buyFee * amount)) {
            _mint(msg.sender, amount);
        } else {
            i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));
            _mint(msg.sender, amount);
        }

@>      s_earnTimer = block.timestamp;

        emit SnowBought(msg.sender, amount);
    }

    function earnSnow() external canFarmSnow {
@>      if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
            revert S__Timer();
        }
        _mint(msg.sender, 1);

@>      s_earnTimer = block.timestamp;
    }

Risk

Likelihood: High

Impact: High

Proof of Concept

When an honest user calls earnSnow(), another distinct user cannot call earnSnow() until 1 full week has elapsed.
Moreover, any regular purchase via buySnow() resets s_earnTimer, preventing any user from claiming their weekly
tokens.
Add the following test to test/TestSnow.t.sol:
function test_global_timer_dos_and_buy_snow_reset() public {
// 1. Ashley earns snow at t = 0
vm.prank(ashley);
snow.earnSnow();
assertEq(snow.balanceOf(ashley), 1);

    // 2. Victory tries to earn snow immediately after Ashley; fails because timer is global
    vm.prank(victory);
    vm.expectRevert(Snow.S__Timer.selector);
    snow.earnSnow();

    // 3. Fast forward 6 days (almost 1 full week)
    vm.warp(block.timestamp + 6 days);

    // 4. Jerry buys snow, which erroneously resets s_earnTimer to current timestamp
    vm.startPrank(jerry);
    weth.approve(address(snow), FEE);
    snow.buySnow(1);
    vm.stopPrank();

    // 5. Ashley or Victory attempts to earn snow 2 days later (8 days after initial earn)
    // It should succeed since > 1 week passed since Ashley earned, but reverts because buySnow reset the timer
    vm.warp(block.timestamp + 2 days);
    vm.prank(victory);
    vm.expectRevert(Snow.S__Timer.selector);
    snow.earnSnow();
}

Recommended Mitigation

1. Replace the single global s_earnTimer variable with a mapping mapping(address => uint256) private s_lastEarned;
   to enforce cooldowns per user.

2. Remove the assignment s_earnTimer = block.timestamp; from buySnow(), as purchasing tokens should not interfere
   with the free earning cooldown.
   --- a/src/Snow.sol
   +++ b/src/Snow.sol
   @@ -27,7 +27,7 @@ contract Snow is ERC20, Ownable {
   error S__SnowFarmingOver();

   // >>> VARIABLES
   address private s_collector;
   

-    uint256 private s_earnTimer;
+    mapping(address => uint256) private s_lastEarned;
     uint256 public s_buyFee;
     uint256 private immutable i_farmingOver;

@@ -84,8 +84,6 @@ contract Snow is ERC20, Ownable {
             _mint(msg.sender, amount);
         }

-        s_earnTimer = block.timestamp;
-
         emit SnowBought(msg.sender, amount);
     }

     function earnSnow() external canFarmSnow {
-        if (s_earnTimer != 0 && block.timestamp < (s_earnTimer + 1 weeks)) {
+        if (s_lastEarned[msg.sender] != 0 && block.timestamp < (s_lastEarned[msg.sender] + 1 weeks)) {
             revert S__Timer();
         }
-        _mint(msg.sender, 1);
-
-        s_earnTimer = block.timestamp;
+        s_lastEarned[msg.sender] = block.timestamp;
+        _mint(msg.sender, 1);
     }