First Flight #14: AirDropper

Summary

The users that use account abstraction wallets have different addresses across chains for the same account.

Vulnerability Details

In the docs is said:

The user can claim his/her USDC tokens through the MerkleAirdrop::claim function. This function requires account, amount and proof array. With the help of this three arguments the merkle proof will ensure that the caller is eligible to claim. But in the generated merkle root are used the Ethereum addresses of the lucky users. But the protocol will be deployed on the zkSync era chain. If any of them uses account abstraction wallet, this lucky user will not be able to claim his/her tokens. The account abstraction wallets have different addresses in the different chains for the same account.

Impact

The users that use account abstraction wallets have different addresses on the zkSync era chain. That means these users will not be able to claim their USDC tokens, because the merkle root will require another account address (this on Ethereum).

Tools Used

Manual Review

Recommendations

Ensure that the addresses in makeMerkle file for the lucky users are their addresses for the zkSync era chain.