The SnowmanAirdrop
contract contains a critical typo in the MESSAGE_TYPEHASH
constant. The type signature incorrectly specifies "addres"
instead of "address"
in the string "SnowmanClaim(addres receiver, uint256 amount)"
. This malformed typehash breaks the EIP-712 signature verification mechanism, rendering the entire airdrop contract non-functional.
EIP-712 requires exact string matching for type signatures when computing domain separators and message hashes. The incorrect typehash generates a completely different hash value than what client-side applications would produce when creating signatures with the correct "address"
type, causing all signature validation attempts to fail.
User attempts to claim Snowman NFT by calling claimSnowman()
with valid Merkle proof and signature
Contract calls getMessageHash()
which uses the malformed MESSAGE_TYPEHASH
containing "addres"
The computed message hash differs from the hash used to generate the user's signature (which correctly uses "address"
)
_isValidSignature()
fails to recover the correct signer address from the signature
Transaction reverts with SA__InvalidSignature()
error
No legitimate user can successfully claim their airdrop, regardless of having valid proofs and signatures
The entire airdrop mechanism is non-functional
Fix the typo in SnowmanAirdrop.sol
:
A typo in the `MESSAGE_TYPEHASH` variable of the `SnowmanAirdrop` contract will prevent signature verification claims. Used `addres` instead of `address`
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.