Immutable Merkle root prevents any correction of the tree to save unclaimed airdrop or allowing reusability of the contract.
Description
The Merkle root in MerkleAirdrop.sol is immutable:
This is very risky because once in production, there is no way to change it.
In another submission, I proved the root was incorrect, which was a critical finding because there were no way to change the root.
Moreover, there is no mechanism to retrieve unclaimed airdrops, and changing the Merkle root could add this possibility.
Finally, this contract is only usable once. Being able to change the Merkle root would allow this contract to be used more than once for multiple airdrops (adapting an "anti-multi-claim" mechanism).
Risk
Likelyhood: Low
Impact: Low
No saving mechanism for incorrect Merkle root or unclaimed tokens.
No reusability of the contract.
Recommended Mitigation
Implement a setter for the Merkle root and remove the immutable keyword.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.