Summary

TSender contract is using push over pull technique for sending tokens to multiple addresses for airdropping purposes.

Vulnerability Details

TSender::airdropERC20 is taking Recipient Addresses's Array and Amounts Array for recipients as arguments. And then it iterates over the loop to send tokens to all the addresses in the array. This is a very expensive operation and can lead to out of gas error if the array is too large.

Exploit PoC

By looking at the function as it doesn't have any bounds on recipients array, so we can make array of any size and send it to the function. Opened the contract in remix and tried to send 20000 addresses and 20000 addresses compared to one of the uniswap airdrops where 250k addresses were airdropped with free $UNI Tokens so it's feasible to assume that there can be 20000 addresses in an airdrop.

Lazy enough to input 20000 addresses, wrote python script to generate random 20,000 addresses and amounts arrays.

• Addresses Script:

• Amounts Script:

After generating the arrays, copied the arrays and pasted them in the remix and tried to send the transaction. The transaction failed to execute and reverted to its initial state.

Error Message:

Impact

There are multiple impacts:

• As it is stated by Cyfrin Team, that It can be used in production. With this design it would be impossible to airdrop to a large number of addresses which is actually most of the time the case.

• Using push over pull strategy cause the contract to revert

• Sending tokens to a large number of addresses let's say even for executable array needs a lot of gas to proceed which is not sufficient model for airdropping.

Tools Used

Remix/Python/Manual Testing

Recommendations

• Use pull over push strategy

• Let the user claim airdrop instead of sending it to all the addresses.

• Make recipients array bounded i.e, 1000 addresses at a time as so it can be feasible to send tokens to multiple addresses in batches.