First Flight #14: AirDropper

Summary

One of the addresses in the Merkle Tree is a contract specifically a GnosisSafeProxy contract which uses a delegatecall to forward calls to a singleton (master copy).

Vulnerability Details

The GnosisSafeProxy uses a delegatecall to forward calls to a singleton (master copy):

• State Manipulation: The behavior of the proxy will depend entirely on the state and logic of the master copy it points to. If the master copy is updated or points to a malicious contract, the behavior of the proxy in your airdrop process could lead to security vulnerabilities.

• Transaction Calls: The proxy can be used to interact with your contract in a high-level manner, possibly invoking other contracts or performing actions beyond simple token transfers. This includes invoking contracts that change state, manipulate token balances, or interact with other contracts in a harmful way.

Delegate Call Risks: The use of delegatecall within the proxy can lead to serious vulnerabilities, especially if the contract to which it delegates is not secure. This could potentially lead to the execution of unintended logic that can manipulate the proxy's state.

Impact

This specific case highlights the fact that a malicious contract or a proxy contract, if selected, can interact with and introduce a potential risk of draining or taking control of the contract.

Tools Used

Manual review

Recommendations

In the process of winners selection be sure to select only EOAs, in case or contract addresses are mandatory use at least reentrancy guard in MerkleAirdrop:claim and ensuring that they are properly configured and not susceptible to attacks that could impact the broader system. Ask for review before to select it.