Wrong ZKSync USDC Address
Summary
There is a typographical error in the USDC address used when deploying the MerkleAirdrop.sol File.
Vulnerability Details
The USDC address in the deploy.s.sol contract was: 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4
The actual USDC address in ZK Sync is : 0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4
By the naked eye it might not look so obvious but "a" was mistakenly typed as "b" at the 22th hex character.
Impact
The eligible users would not be able to claim the USDC airdrop when calling the "claim" function it will revert since the wrong USDC address is an EOC and does not support function calls.
Tools Used
Blockchain Explorer to trace the USDC contract
Manual review of the deploy.s.sol contract.
Recommendations
Use the correct USDC address: 0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4
Lead Judging Commences
usdc-wrong-address
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.