First Flight #14: AirDropper

Summary

Claimed event should be announced after the airdrop transfer has succeeded.

Vulnerability Details

It is good practice to emit the claimed event after the transfer succeeded:
Bad practice:
function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
//..
emit Claimed(account, amount);
i_airdropToken.safeTransfer(account, amount);
}

Impact

Nothing really

Tools Used

Manual Review

Recommendations

Use the Good Practice of emitting events after it actually happened.
function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
//..
i_airdropToken.safeTransfer(account, amount);
emit Claimed(account, amount);
}