When `msg.value` does not exactly equal `s_buyFee * amount`, `buySnow` falls into the WETH branch without reverting or refunding the ETH that was sent. The buyer pays the full price in WETH and loses the ETH, which `collectFee` later sweeps to the collector.

if (msg.value == (s_buyFee * amount)) {

_mint(msg.sender, amount);

} else {

// @> msg.value can be non-zero here and is silently kept

i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));

_mint(msg.sender, amount);

}

* The user sends a slightly wrong ETH amount (rounding, frontend bug) while holding a WETH approval to the contract.

* The user loses all the ETH sent and is charged the full price again in WETH.

function test_M1_buySnowKeepsEthAndAlsoChargesWeth() public {

uint256 price = snow.s_buyFee() * 2;

address buyer = makeAddr("buyer");

// WETH actually used by Snow (i_weth, storage slot 9)

MockWETH weth = MockWETH(address(uint160(uint256(vm.load(address(snow), bytes32(uint256(9)))))));

vm.deal(buyer, price);

weth.mint(buyer, price);

​

vm.startPrank(buyer);

weth.approve(address(snow), price);

snow.buySnow{value: price - 1}(2); // 1 wei short

vm.stopPrank();

​

assertEq(snow.balanceOf(buyer), 2);

assertEq(buyer.balance, 1); // ETH taken

assertEq(weth.balanceOf(buyer), 0); // WETH taken too

}

} else {

i_weth.safeTransferFrom(msg.sender, address(this), (s_buyFee * amount));