First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Not checking if deployer has enough Ether can lead to airdrop contract being deployed with zero USDC or completely failed script.

mirkopezo

Summary

Deploy script does not check if deployer has enough Ether to cover transaction fee for deploying airdrop contract and transferring USDC to it.

Vulnerability Details

Caller first deploys airdrop contract and then transfers USDC to address of airdrop contract.

If caller does not have enough Ether to deploy contract, script will fail.

Another issue is if caller have enough Ether to deploy contract but not enough to transfer USDC to it, which leaves airdrop contract deployed with zero USDC.

@> function run() public {
vm.startBroadcast();
MerkleAirdrop airdrop = deployMerkleDropper(s_merkleRoot, IERC20(s_zkSyncUSDC));
// Send USDC -> Merkle Air Dropper
IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);
vm.stopBroadcast();
}

Impact

2 possible scenarios:

  • Script fails because caller does not have enough Ether to deploy contract.

  • Script will deploy contract, but caller does not have enough Ether to transfer USDC to airdrop contract. Airdrop contract will have zero USDC so it means it is not initialized correctly and it will be unusable for users.

Tools Used

Manual review

Recommendations

Check what is deployment cost for aidrop contract, and what is cost of calling transfer function on USDC token using this command:

forge test --gas-report

Then check what is gas price on zkSync Era using this command:

cast gas-price --rpc-url https://mainnet.era.zksync.io

Each of cost from first step multiply by gas price and add those two costs together. This will be estimated gas cost for running script correctly, there is possibility it fee could be little bit lower or higher than estimated amount.

function run() public {
vm.startBroadcast();
+ uint256 estimatedCost = 0.1 ether; // this is just example
+ require(msg.sender.balance >= estimatedCost, "Insufficient balance");
MerkleAirdrop airdrop = deployMerkleDropper(s_merkleRoot, IERC20(s_zkSyncUSDC));
// Send USDC -> Merkle Air Dropper
IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);
vm.stopBroadcast();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.