First Flight #14: AirDropper

Summary

Every user that qualifies for the airdrop can generate a proof in order to claim their airdrop but the claim function does not keep track of users that have already claimed their airdrop. This will allow the user to continuously claim the airdrop over and over again until the all the funds in the contract is drained.

Vulnerability Details

The claim function fails to keep track of users who have already claimed their airdrops. As a result, users who are eligible for the airdrop can claim the airdrop multiple times. This loophole allows malicious actors to drain the contract of all available funds by continuously claiming the airdrop.

POC

Impact

The vulnerability poses a severe risk of financial loss and undermines the fairness of the airdrop distribution process. Malicious actors can exploit the loophole to deplete the contract's funds, leading to potential economic harm to legitimate users and damaging the reputation of the protocol.

Tools Used

Manual Review

Recommendations

It is imperative to implement robust measures to prevent duplicate claims and ensure the integrity of the airdrop distribution. This may involve implementing a mechanism to track and verify users who have already claimed their airdrops, such as maintaining a record of claimed addresses or using unique claim identifiers. By addressing this critical issue, the contract can enhance security, promote fairness, and maintain the trust of its user base.