First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect USDC address on zkSync era, making users unable to claim tokens

0xlouistsai

Summary

The USDC token address is incorrect in ./script/Deploy.s.sol, preventing users from claiming their tokens, and protocol owners cannot withdraw the tokens they deposited.

Vulnerability Details

The USDC token address on zkSync Era is 0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4, but the Deploy::s_zkSyncUSDC value provided is 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4, which is slightly different. This discrepancy is highlighted below:

Correct Value: 0x1d17CBcF0D6D143135 'a' E902365D2E5e2A16538D4
Incorrect Value: 0x1D17CbCf0D6d143135 'b' e902365d2e5E2a16538d4

This incorrect value is passed as the MerkleAirdrop::i_airdropToken value.

Impact

The address passed as MerkleAirdrop::i_airdropToken is incorrect, but the USDC token address for transfer is correct in Deploy::run

contract Deploy is Script {
// The following address is incorrect
@> address public s_zkSyncUSDC = 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4;
​
function run() public {
vm.startBroadcast();
MerkleAirdrop airdrop = deployMerkleDropper(s_merkleRoot, IERC20(s_zkSyncUSDC));
// The following address is correct
@> IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);
vm.stopBroadcast();
}
​
function deployMerkleDropper(bytes32 merkleRoot, IERC20 zkSyncUSDC) public returns (MerkleAirdrop) {
return (new MerkleAirdrop(merkleRoot, zkSyncUSDC));
}
}

As a result, when the user wants to claim their reward through MerkleAirdrop::claim, it will revert since the incorrect MerkleAirdrop::i_airdropToken address does not have enough balance.

function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
if (msg.value != FEE) {
revert MerkleAirdrop__InvalidFeeAmount();
}
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount))));
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert MerkleAirdrop__InvalidProof();
}
emit Claimed(account, amount);
@> i_airdropToken.safeTransfer(account, amount);
}

The MerkleAirdrop::i_airdropToken balance is 0, since a different token was sent into the protocol.

The impact is as follows:
(1) User unable to claim rewards
(2) Owner cannot withdraw the USDC token back

Tools Used

Manual Review

Recommendations

Update the Deploy::s_zkSyncUSDC address to the correct USDC token address.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

usdc-wrong-address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.