First Flight #14: AirDropper

Summary

No limits or checks on the amount? An attacker can drain the entire account, or at least DOS the contract if set an amount higher than what is inside the contract

Vulnerability Details

function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
    if (msg.value != FEE) {
        revert MerkleAirdrop__InvalidFeeAmount();
    }
    bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount)))); 
    if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
        revert MerkleAirdrop__InvalidProof();
    }
    emit Claimed(account, amount);
    i_airdropToken.safeTransfer(account, amount);
}

The function claim has no checks on the amount claimed so an attacker can drain all the funds

Impact
The impact of this vulnerability is severe, as it allows an attacker to drain the funds or cause a DOS to the contract.

Tools Used
Manual review

Recommendations
Maybe add a require statement to check whether the amount passed in is reasonable.