First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Any amount not claimed will be stuck in the contract

wetzo

Summary

At deployment, all the tokens needed for the airdrop are transfered to the contract. If an address never claims its airdrop, the tokens will stay forever in the contract. As the airdrop list was built using L1 activity, it is likely that at least some of the eligible users won't have any interest in the zkSync blockchain or won't know of the airdrop.

Vulnerability Details

Airdroped token are transfer to the contract during deployment.

// 4 users, 25 USDC each
uint256 public s_amountToAirdrop = 4 * (25 * 1e6);
​
// Send USDC -> Merkle Air Dropper
IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);

If they are not claimed, there is no way to get them back.

Impact

Tokens will get stuck in the contract, leading to fund losses for the protocol.

Tools Used

Manual review

Recommendations

Set a claim deadline and implement a function allowing the owner to withdraw any leftover token after the deadline.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.