Submission Details
Severity:
[M-1] `Claimed` event should be emited after the transfer in `MerkleAirdrop::claim()` function
Vulnerability Details and impact
The MerkleAirdrop::claim() function emits a Claimed event evertime users attempt to claim their airdrop. This occurs regardless of the transaction's success, meaning users and off-chain indexers might see the event even if the funds haven't been transferred successfully yet.
Tools Used
Manual review
Recommendations
Refactor the function to make it emit the Claimed event after the transfer transaction:
function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
...
- emit Claimed(account, amount);
i_airdropToken.safeTransfer(account, amount);
+ emit Claimed(account, amount);
}
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Info
Rewards breakdown
nSLOC
62This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.