First Flight #14: AirDropper

Summary

In MerkleAirdrop::claim() function, the MerkleProof.verify function is incorrectly used, making merkle proof verification insecure.

Vulnerability Details

The MerkleProof.verify function is used to verify the merkle proof. However, this verifies the proof against the raw calldata, which is insecure.

Impact

Because MerkleProof.verify is used instead of MerkleProof.verifyCalldata, the merkle proofs can be forged, allowing attackers to claim airdropped tokens they are not entitled to.

Tools Used

Manual review, docs

Recommendations

Replace the use of MerkleProof.verify with MerkleProof.verifyCalldata in MerkleAirdrop.sol lines 35 to properly verify proofs against a hash of the calldata.