First Flight #14: AirDropper

Summary

The USDC token used for Airdrop is USDC token which is of 6 decimal on zkSync.

The amount used for calculation of Merkle root for every winner is 25 USDC, therefore it should be 25 * 1e6 considering the 6 decimals of USDC token, but the actual amount used is 25 * 1e18 which directly affects the calculated root and makes the Airdrop unclaimable and also results in locked funds.

Vulnerability Details

• The vulnerability is present in the makeMerkle.js file which is used to get the Merkle root and that calculated root is directly used in Deploy.s.sol which sets the Merkle root in MerkleAirdrop contract, thus affecting the functionality of MerkleAirdrop contract.

• The USDC token has 6 decimals but the Merkle root is calculated using 18 decimals for the amount calculation for each winner. But as the actual decimal is 6, therefore the set amount 25 * 1e18 will not be equivalent to 25 USDC but it will be 25 * 1e12 USDC.

• As a result of which when a user tries to claim there Airdrop with amount being 25 * 1e6 (25 USDC), the call will revert as the nodes of Merkle tree were made by 25 * 1e18 as amount and no one will be able to claim the Airdrop.

Impact

• Incorrect Merkle root used in Deploy scripts.

• No one will be able to claim the Airdrop.

• Locked Airdrop token balance inside MerkleAirdrop contract.

Tools Used

Manual Review

Recommendations

Recalculate the Merkle root used in Deploy scripts by correcting the decimal of amount in makeMerkle.js.

• Correct the amount in makeMerkle.js at line 7

• Recalculate the Merkle Root my running yarn run makeMerkle

• Update the Merkle Root inside Deploy.s.sol at line 9