There is no function to update the root but an event for that is created
As the root can't be updated a Merkle validation can only be performed for the initial four addresses.
Probably the contract owners intend to add more addresses in the future, if not they wouldn't have used Merkle tree for four addresses, and the event
event MerkleRootUpdated(bytes32 newMerkleRoot);
is created which, but a function was forgotten to be added.
Only the initial four addresses can claim the reward.
Manual review
Add an option for the owner to update the root.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.