First Flight #14: AirDropper

Summary

The transaction fee for claiming airdrop tokens is hardcoded within the contract, which limits the contract's adaptability to changing network conditions or economic factors.

Vulnerability Details

The claim function requires a fee to be paid in ETH, which is set as a constant value within the contract. This fee cannot be adjusted without redeploying the contract, which could be problematic if the fee needs to be changed due to fluctuating gas prices or changes in the token's value.

Impact

The inability to adjust the fee could lead to either excessive fees that deter users from claiming their airdrop or fees that are too low to cover future increases in transaction costs, potentially making the airdrop unsustainable.

Tools Used

Manual Code Review

Proof of code

The hardcoded fee is defined as a constant at the beginning of the contract:

And it is checked within the claim function:

Recommendations

To provide flexibility in fee management, consider replacing the constant with a state variable that can be updated by the contract owner:

In the claim function, replace the constant FEE with the state variable i_fee:

Additionally, emit an event when the fee is updated to ensure transparency:

Implementing these changes will allow the contract owner to adjust the fee in response to changes in network conditions or economic factors, ensuring the airdrop remains accessible and economically viable.