First Flight #14: AirDropper

Summary

1e9 WEI fee instead of 1e9 ETH fee in MerkleAirdrop

Vulnerability Details

In the docs is stateed that user should pay 1e9 ETH to claim the amount.
The claim function requires a 1e9 ETH fee to be paid, and the owner of the contract is the only one who should be allowed to withdraw it with claimFees.

The actual FEE in the contract is 1e9 WEI

uint256 private constant FEE = 1e9;

I put this as low because most likely it is a mistake in the docs, than intension to take 1e9 ETH fee, because it seems unreasonable.

Impact

Tools Used

Manual Review

Recommendations