Account abstraction not considered
Summary
The docs states that the lucky addresses are "based on their activity on the Ethereum L1". However, the protocol is deployed zkSync era chain. It is possible that those addresses are not the same due to a possible account abstraction.
Vulnerability Details
The account abstraction might prevent the users from successful claim of the air drop if the zkSync address is different from the Ethereum L1 one. This will lead to an invalid merkle proof and the funds will be stuck in the protocol.
Impact
Users cannot claim the airdrop. Funds will be stuck in the protocol.
Tools Used
Manual Review
Recommendations
Add a mechanism for changing the merkle root of the protocol or carefully check the zkSync addresses of the users.
Lead Judging Commences
smart-contract-wallet-not-the-same-on-l2
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.