Vyper Vested Claims
First Flight #34
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Merkle root update could broke user allocation claims

irfi

Summary

Merkle root update could potentially modify user allocations. Missing validation that the new merkle root maintains the same total allocation.

Vulnerability Details

The function set_merkle_root could be called by the owner whenever they want. There's no check that ensures that the previous allocation still exists and the total amount is the same.

Impact

It is possible that user could not claim after the owner change the merkle root.

PoC

def test_vuln_claim_after_rescue_token(self):
self.airdrop.set_merkle_root(b"0x0")
​
# this will revert, transfer will fail
with boa.reverts():
self.airdrop.claim(self.user1, self.amount, self.proof)

Recommendations

Consider limiting when the set_merkle_root can be called. E.g. before vesting_start_time

Updates

Appeal created

bube Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] No checks in `set_merkle_root` function

The `set_merkle_root` function is called only by the `owner` and the `owner` is trusted. This means the input argument `merkle_root` will be correct and the `owner` will not call again the `set_merkle_root` function.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.