First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-1] Wrong calculation of merkle root causes DoS

bijan

Summary

s_merkleRoot variable in the Deploy.s.sol stores and passes the wrong computed merkle root for deployment and users won't be able to verify their proofs.

Vulnerability Details

USDC unlike many other standard ERC20 tokens has 6 decimals which is an important matter for calculating the correct amount of tokens. However the protocol mistakenly calculates it with 18 decimals which is reflected in the makeMerkle.js and subsequently in the Deploy.s.sol::s_merkleRoot variable which is responsible for passing the computed merkle root for deployment as a constructor input and it will be stored and used in the MerkleAirdrop.sol as an immutable variable.

Impact

Users won't be able to verify their proofs and claim their USDC tokens, unless there is 25 trillion (25000000000000.000000) USDC tokens in the MerkleAirdrop contract!

Tools Used

Manual review

Recommendations

Refactor your amount input of makeMerkle.js in order to get the correct merkle root then run make merkle:

- const amount = (25 * 1e18).toString()
+ const amount = (25 * 1e6).toString()
​
// Result for merkle root: 0x3b2e22da63ae414086bec9c9da6b685f790c6fab200c7918f2879f08793d77bd

Then replace Deploy.s.sol::s_merkleRoot with the correct value:

- bytes32 public s_merkleRoot = 0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05;
+ bytes32 public s_merkleRoot = 0x3b2e22da63ae414086bec9c9da6b685f790c6fab200c7918f2879f08793d77bd;
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

wrong-usdc-decimals-in-merkle

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.