Account abstraction will lead to some users not being able to claim their airdrop amounts
Description
Users using wallets with account abstraction will have different addresses on different chains. The merkle root is generated from the account addresses from the Ethereum L1, as stated in the documentation. This will render some users unable to claim their airdrop amounts on the zkSync Era Mainnet.
Impact
Severity: High
Likelihood: Medium
Some users will not be able to claim their airdrop amounts from the MerkleAirdrop contract. Additionally, the unclaimed tokens will remain stuck in the contract since there is no function available for the owner to withdraw the remaining balance.
Tools Used
Manual review.
Recommended Mitigation
Generate the merkle root from the correct zkSync Era Mainnet addresses instead of the Ethereum addresses.
Lead Judging Commences
smart-contract-wallet-not-the-same-on-l2
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.