First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect zkSync Era USDC address leads to tokens being stuck in the airdrop contract

mgnfy_view

Description

The deployment script declares the zkSync Era Mainnet USDC token address as 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4 at line 8. However, the actual token address is 0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4. The wrong address uses a b instead of an a as the 21st character. The MerkleAirdrop receives the wrong token address, which causes all token transfers to fail when users try to claim their airdrop amounts, essentially locking the funds in the contract.

Impact

Severity: High
Likelihood: High

The MerkleAirdrop contract receives an invalid zkSync Era USDC address. However, the correct address is used to transfer USDC to the contract at line 18 in the deployment script. This will cause the USDC tokens to be stuck in the contract, as all transfers will fail when users will try to claim their airdrop amounts. The fact that the token pointed to by the MerkleAirdrop contract is immutable and cannot be changed by the owner of the contract aggravates the issue.

Tools Used

Manual review.

Recommended Mitigation

Use the correct zkSync Era Mainnet USDC address, and use the same address variable throughout the deployment script. If the same variable (with incorrect address) had been used throughout, the deployment script would have failed at line 18 (token tranfer to the MerkleAirdrop contract), saving the protocol team from loss of funds.

In the deployment script, make the following changes:

- address public s_zkSyncUSDC = 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4;
+ address public s_zkSyncUSDC = 0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4;
bytes32 public s_merkleRoot = 0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05;
// 4 users, 25 USDC each
uint256 public s_amountToAirdrop = 4 * (25 * 1e6);
​
// Deploy the airdropper
function run() public {
vm.startBroadcast();
MerkleAirdrop airdrop = deployMerkleDropper(s_merkleRoot, IERC20(s_zkSyncUSDC));
// Send USDC -> Merkle Air Dropper
- IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);
+ IERC20(s_zkSyncUSDC).transfer(address(airdrop), s_amountToAirdrop);
vm.stopBroadcast();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

usdc-wrong-address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.