First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect s_merkleRoot value in deployment phase, preventing users from claiming rewards

0xlouistsai

Summary

The s_merkleRoot value is incorrect due to the wrong decimal value passed in makeMerkle.js helper, resulting in users being unable to claim their rewards.

Vulnerability Details

The calculation in makeMerkle.js incorrectly uses the decimal value for USDC as 18 instead of the correct value of 6. Consequently, an incorrect merkle root is produced and used in the Airdrop process.

const amount = (25 * 1e18).toString() // USDC Decimal is 6
const userToGetProofOf = "0x20F41376c713072937eb02Be70ee1eD0D639966C"

The proof-of-concept is provided below:

contract InvalidMerkleRootValue is Test {
MerkleAirdrop public airdrop;
AirdropToken public token;
bytes32 public merkleRoot = 0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05;
_CheatCodes cheatCodes = _CheatCodes(VM_ADDRESS);
uint256 amountToCollect = (25 * 1e6); // 25.000000
uint256 amountToSend = amountToCollect * 4;
address collectorOne = 0x20F41376c713072937eb02Be70ee1eD0D639966C;
​
bytes32 proofOne = 0x4fd31fee0e75780cd67704fbc43caee70fddcaa43631e2e1bc9fb233fada2394;
bytes32 proofTwo = 0xc88d18957ad6849229355580c1bde5de3ae3b78024db2e6c2a9ad674f7b59f84;
bytes32[] proof = [proofOne, proofTwo];
​
function setUp() public {
token = new AirdropToken();
airdrop = new MerkleAirdrop(merkleRoot, token);
token.mint(address(this), amountToSend);
token.transfer(address(airdrop), amountToSend);
}
​
function testIncorrectMerkleRootValue() public {
vm.deal(collectorOne, airdrop.getFee());
​
uint256 feeAmount = airdrop.getFee();
vm.startPrank(collectorOne);
vm.expectRevert();
airdrop.claim{value: feeAmount}(collectorOne, amountToCollect, proof);
vm.stopPrank();
}
}

Impact

With the incorrect merkle root value, and the corresponding incorrect proof generated by makeMerkle.js, all users will be unable to claim rewards through MerkleAirdrop::claim, since the verification of merkle tree will not pass.

Tools Used

Manual Review

Recommendations

Update the merkle root to correct value and replace the s_merkleRoot value.

  1. Update the USDC decimal value to 6.

  2. Re-generate the merkle root to 0x3b2e22da63ae414086bec9c9da6b685f790c6fab200c7918f2879f08793d77bd

  3. Update the s_merkleRoot to correct value

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

wrong-usdc-decimals-in-merkle

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.