First Flight #14: AirDropper

Summary

The value defined in Deploy::s_merkleRoot contract does not match the value of the root of the used merkleTree for this airdrop.

Vulnerability Details

In the makeMerkle.js file we have the following snippet of code:

If we execute

we obtain that the Root value is the same as the one wrote in Deploy::s_merkleRoot :

However, the tree that has that root value assumes that the token that we´re airdropping has 18 decimals !

USDC has 6 decimals. So, the correct amount would be:

Doing the previous change, the output of

is :

The same value used as a root in the MerkleAirdropTest file.

Impact

Every claim call from the winners will revert, because the "amount" values of the merkleTree (18 decimals) and the actual amount of tokens that will be withdrawn (6 decimals) is different, and therefore the verification functionwill return false at every call.

Is worth noting that if somebody actually discovered it and thought that calling the function with the amount with 18 decimals would grant them way more than they should, in the current state because there is only 100 + 6 decimals USDC in the contract, there`s not enough supply so it would ultimately revert in the line

due to lack of funds.

Tools Used

VScode, Foundry

PoC

using

We obtain the following result:

Modifying the MerkleAirdropTest contract with these values:

and executing the current test testUsersCanClaim() we get the Invalid Proof error

If we also change the value of the amount like this:

The test reverts with the Insufficient Balance error:

Recommendations

Modify the value of the MerkleRoot in the Deploy contract to the correct value found in the MerkleAirdropTest file :
0x3b2e22da63ae414086bec9c9da6b685f790c6fab200c7918f2879f08793d77bd