First Flight #14: AirDropper

Summary

The protocol mentions that it will deploy the MerkleAirdrop contract via the Deploy.s.sol script using Makefile deploy command.

But the command doesn't have the label --zksync which will not allow the Deploy script to deploy the contract and along with that the command uses --verify for verification on the block explorer but foundry-zksync currently doesn't support verification.

Vulnerability Details

The vulnerability is present in the Makefile where the deploy command doesn't add the label --zksync to make it deployable on zkSync chain, and along with that --verify is not supported in foundry-zksync and it cannot be verified.

Impact

• Deploy scripts will not be able to run.

• As a result of which MerkleAirdrop contract will not be able to deploy.

Tools Used

Manual Review

Recommendations

Add --zksync label in the command.