There is no check that user has already claimed.
Summary
Once a user claims, he can claim again as there are no checks to see if he has already claimed.
Vulnerability Details
Contract lacks functions that can make sure each user can claim only once similar to functions isClaimed() and _setClaimed() in :
https://github.com/Uniswap/merkle-distributor/blob/master/contracts/MerkleDistributor.sol#L33C14-L33C25
Impact
The impact is that a user can get all 100 USDC.
Tools Used
Visual inspection
Recommendations
add a combination of mapping and function that will check that user has already claimed similar to :
https://github.com/Uniswap/merkle-distributor/blob/master/contracts/MerkleDistributor.sol#L33C14-L33C25
Lead Judging Commences
multi-claim-airdrop
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.