First Flight #14: AirDropper

Summary :

Owner can drain entire contract balance.

Vulnerability Details

The claimFees function, accessible only by the contract owner, can be used to drain the entire contract balance by passing address(this).balance in the value .
This allows the owner to transfer all funds to their own address, potentially leaving users who have not yet claimed their tokens with nothing.

Impact

the owner could exploit this vulnerability to drain the entire contract balance, resulting in financial loss for users.

• if owner claimed before everyone : owner claim 100

• if one address claimed before owner : owner claim 75 + 1e9

• if two address claimed before owner : owner claim 50 + 2e9

• if three address claimed before owner : owner claim 25 + 3e9

Tools Used

Manual Review

Recommendations

Modify the claimFees function to only allow the owner to claim the fee amount, rather than allowing them to drain the entire contract balance. Additionally, consider implementing a mechanism to ensure that users have had a chance to claim their tokens before allowing the owner to claim fees.