Submission Details
Severity:
Wrong Decimal Points Used in `makeMerkle.js`
[M-1] Wrong Decimal Points Used in makeMerkle.js
Description: in makeMerkle.js file the value for usdc decimals is set to 25 * 1e18 but because usdc has 6 decimal points, the final proof and even root will be diffrent.
const { StandardMerkleTree } = require("@openzeppelin/merkle-tree")
const fs = require("fs")
/*//////////////////////////////////////////////////////////////
INPUTS
//////////////////////////////////////////////////////////////*/
@> const amount = (25 * 1e18).toString()
const userToGetProofOf = "0x20F41376c713072937eb02Be70ee1eD0D639966C"
Impact: This will cause users to fail to claim their airdrops.
Proof of Concept: Add this test to existing test suit:
function testMerkleJsIsWrong() public {
vm.deal(collectorOne, airdrop.getFee());
vm.startPrank(collectorOne);
vm.expectRevert();
airdrop.claim{value: airdrop.getFee()}(
collectorOne,
amountToCollect,
wrongProof
);
vm.stopPrank();
}
Recommended Mitigation: fix the Decimal points in makeMerkle.js from 1e18 to 1e6.
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
wrong-usdc-decimals-in-merkle
Rewards breakdown
nSLOC
62This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.