Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Message hash typo "addres" in SnowmanAirdrop

0xchaddb

Signature verification is completely broken due to a typo in the EIP-712 message hash in SnowmanAirdrop::MESSAGE_TYPEHASH

Description: The MESSAGE_TYPEHASH constant contains a critical typo where "address" is misspelled as "addres", causing a mismatch between the expected and actual type signatures. This breaks EIP-712 signature verification entirely.

bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)");
// ^^^^^^^ Missing 's'

This typo means:

  • Legitimate signatures generated with correct tools will be rejected

  • The signature verification mechanism is fundamentally broken

  • Potential for signature bypass vulnerabilities

  • Complete breakdown of the authorization system

Impact: Complete breakdown of signature-based authorization, potential unauthorized claims.

Proof of Concept:

function test_EIP712TypoVulnerability() public {
// The contract has a typo: "addres" instead of "address"
bytes32 contractHash = keccak256("SnowmanClaim(addres receiver, uint256 amount)");
bytes32 correctHash = keccak256("SnowmanClaim(address receiver, uint256 amount)");
// These are different, proving the typo exists
assertTrue(contractHash != correctHash);
// This means legitimate signatures generated with correct tools will fail
// And potentially crafted signatures might bypass verification
}

Recommended Mitigation: Fix the typo in the MESSAGE_TYPEHASH:

bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(address receiver, uint256 amount)");
// ^^^^^^^ Corrected spelling
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inconsistent MESSAGE_TYPEHASH with standard EIP-712 declaration

A typo in the `MESSAGE_TYPEHASH` variable of the `SnowmanAirdrop` contract will prevent signature verification claims. Used `addres` instead of `address`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.