First Flight #14: AirDropper

Summary

The visibility of the Deploy:deployMerkleDropper function is public leading to multiple instances of the MerkleAirdrop contract.

Vulnerability Details

As Deploy:deployMerkleDropper function has a public visibiliy, mutliple instance of MerkleAirdrop can be deployed

Impact

Multiple instances of the MerkleAirdrop contract can result in confusion or errors, such as the wrong contract being used by users to claim airdrops or multiple contracts holding funds when only one was intended to be funded and used.

Tools Used

Manual review

Recommendations

Modify the visibility of the deployMerkleDropper function to internal or private to be used within the Deploy contract itself or consider implementing access control mechanisms, such as requiring that the caller be the owner or have specific permissions (using modifiers such as onlyOwner if the contract inherits from Ownable).