First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

recipents cannot claim airdrop

0xanmol

Summary

Recipients cannot claim airdrop because of invalid merkel root creation.

Vulnerability Details

USDC have 6 decimal but when we create a merkel root for the airdrop recipient we are using 25 * 1e18.

https://github.com/Cyfrin/2024-04-airdropper/blob/781cf225664a4ad11e9654aaa39cc528016bf214/makeMerkle.js#L7

​
-> const amount = (25 * 1e18).toString()
const userToGetProofOf = "0x20F41376c713072937eb02Be70ee1eD0D639966C"
​
// (1)
const values = [
[userToGetProofOf, amount],
["0x277D26a45Add5775F21256159F089769892CEa5B", amount],
["0x0c8Ca207e27a1a8224D1b602bf856479b03319e7", amount],
["0xf6dBa02C01AF48Cf926579F77C9f874Ca640D91D", amount]
]
​

As you can see the tree is created with 25 tokens for each recipient but with 18 decimals. But in a deploy script only 100e6 tokens are sent to the contract which is correct because USDC has only 6 decimals.

https://github.com/Cyfrin/2024-04-airdropper/blob/781cf225664a4ad11e9654aaa39cc528016bf214/script/Deploy.s.sol#L11

contract Deploy is Script {
address public s_zkSyncUSDC = 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4;
bytes32 public s_merkleRoot = 0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05;
// 4 users, 25 USDC each
-> uint256 public s_amountToAirdrop = 4 * (25 * 1e6);
​
// Deploy the airdropper
function run() public {
vm.startBroadcast();
MerkleAirdrop airdrop = deployMerkleDropper(s_merkleRoot, IERC20(s_zkSyncUSDC));
// Send USDC -> Merkle Air Dropper
IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);
vm.stopBroadcast();
}

When recipent try to claim with 25e18 the function will revert with MerkleAirdrop__InvalidProof because merkel root is created with 25e18 not with 25e6. Again if user try with 25e18, it will verify the proof but will revert with Insufficient ERC20 Balance because contract only have 100e6 balance and trying to transfer 25e18 will revert.

Impact

No one can claim the airdrop.

Tools Used

Manual review

Recommendations

Create a mekel tree with 25 * 1e6 instead of 25 * 1e18.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

wrong-usdc-decimals-in-merkle

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.