First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect `s_merkleRoot` value in `Deploy.s.sol` disrupts airdrop functionality

ebok21

Description:
The s_merkleRoot value set in the Deploy.s.sol contract is incorrect due to a logical error in the makeMerkle.js script. The script incorrectly calculates the Merkle root with an amount value of 25 * 1e18 instead of 25 * 1e6 (considering USDC has 6 decimals). This discrepancy results in a wrong Merkle root value (0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05) being set in the Deploy.s.sol contract. However the correct value is still used in MerkleAirdropTest.t.sol which allows all tests to pass.

contract Deploy is Script {
// ...
​
@> bytes32 public s_merkleRoot = 0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05;
// ...
}

Impact:
This incorrect Merkle root value can lead to failed claims in the MerkleAirdrop contract, as the verification process relies on the correct Merkle root. Users attempting to claim tokens based on the incorrect Merkle root will be unable to do so, potentially leading to confusion and frustration among users.

Proof of Code:

  1. Make the following changes to MerkleAirdrop.t.sol-

Changes
// ...
+ import { Deploy } from "../script/Deploy.s.sol";
​
contract MerkleAirdropTest is Test {
// ...
+ MerkleAirdrop public airdropWithWrongRoot;
+ Deploy deployer;
​
// ...
​
function setUp() public {
token = new AirdropToken();
+ deployer = new Deploy();
+ airdropWithWrongRoot = deployer.deployMerkleDropper(0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05, token);
// ...
}

  1. Add the following test and run forge test --zksync --mt testRevertsWithInvalidProof

POC
function testRevertsWithInvalidProof() public {
uint256 fee = airdrop.getFee();
vm.deal(collectorOne, fee);
​
vm.expectRevert(MerkleAirdrop.MerkleAirdrop__InvalidProof.selector);
vm.prank(collectorOne);
airdropWithWrongRoot.claim{ value: fee }(collectorOne, amountToCollect, proof);
}

Recommended Mitigation:
To correct this issue, the makeMerkle.js script should be updated to use the correct amount value (25 * 1e6) when calculating the Merkle root. This will ensure that the generated Merkle root matches the expected value (0x3b2e22da63ae414086bec9c9da6b685f790c6fab200c7918f2879f08793d77bd) to be used during deployment in the Deploy.s.sol contract.

bytes32 public s_merkleRoot = 0x3b2e22da63ae414086bec9c9da6b685f790c6fab200c7918f2879f08793d77bd;

Tools Used: Manual review and Foundry for POC

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

wrong-usdc-decimals-in-merkle

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.