First Flight #14: AirDropper

Summary

The MerkleAirdrop contract is vulnerable to denial of service attacks due to lack of validation on the Merkle proof length.

Vulnerability Details

The MerkleAirdrop::claim() function calls MerkleProof.verify() with the supplied Merkle proof, but does not first check that the proof length is greater than 0. This allows anyone to pass an empty Merkle proof that will fail verification.

Impact

Attackers can repeatedly call the MerkleAirdrop::claim() function with empty Merkle proofs, causing the verification to fail each time. This can prevent legitimate users from being able to successfully claim their airdropped tokens.

Tools Used

Manual Review

Recommendations

Add a require statement in MerkleAirdrop::claim() function to check merkleProof length before verifying:

This will revert the transaction if an empty proof is supplied, preventing the denial of service.