Beginner FriendlyDeFiFoundry
100 EXP
View results
Submission Details
Severity: low
Invalid

[M-1] `Claimed` event should be emited after the transfer in `MerkleAirdrop::claim()` function

Vulnerability Details and impact

The MerkleAirdrop::claim() function emits a Claimed event evertime users attempt to claim their airdrop. This occurs regardless of the transaction's success, meaning users and off-chain indexers might see the event even if the funds haven't been transferred successfully yet.

Tools Used

Manual review

Recommendations

Refactor the function to make it emit the Claimed event after the transfer transaction:

function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
...
- emit Claimed(account, amount);
i_airdropToken.safeTransfer(account, amount);
+ emit Claimed(account, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.