First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Not checking if deployer has enough USDC can lead to airdrop contract being deployed with zero USDC.

mirkopezo

Summary

Deploy script does not check if deployer has enough USDC to cover amount that will be airdropped.

Vulnerability Details

Deploy script first deploys airdrop contract and then transfers USDC to address of airdrop contract. Problem arises if deployer does not have enough USDC to cover total amount that will be airdropped (100 USDC). In that scenario airdrop contract will be still deployed and it will have 0 USDC which is not intended after running deploy script.

function run() public {
vm.startBroadcast();
MerkleAirdrop airdrop = deployMerkleDropper(s_merkleRoot, IERC20(s_zkSyncUSDC));
// Send USDC -> Merkle Air Dropper
// @audit - this transfer can fail
@> IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);
vm.stopBroadcast();
}

Impact

If deployer does not have enough USDC, contract will be deployed with zero USDC, which leaves users unable to claim any USDC.

Tools Used

Manual review

Recommendations

Check that deployer has enough USDC to cover amount that will be airdropped before deploying airdrop contract.

function run() public {
vm.startBroadcast();
+ uint256 callerUSDCBalance = IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).balanceOf(msg.sender);
+ require(callerUSDCBalance >= s_amountToAirdrop, "Insufficient USDC balance for airdrop");
MerkleAirdrop airdrop = deployMerkleDropper(s_merkleRoot, IERC20(s_zkSyncUSDC));
// Send USDC -> Merkle Air Dropper
IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);
vm.stopBroadcast();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Invalid according to docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.