First Flight #14: AirDropper

Summary

The USDC address in the deploy contract is wrong.

Vulnerability Details

This is the USDC address the MerkleAirdrop will be deployed with: address public s_zkSyncUSDC = 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4;
and this is the correct one 0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05.

The MerkleAirdrop contract will be deployed with the wrong address as an airdropToken, however, the initial transfer of USDC to the MerkleAidrop is done correctly, and the USDC will remain stuck in the contract.

IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);

Impact

The four lucky users won't be able to get their reward and the USDC will remain stuck in the MerkleAirdrop contract.

Tools Used

Manual Review

Recommendations

Use the correct address.