Snowman Merkle Airdrop

First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Submission Details
Severity: high
Valid

Malformed EIP-712 typehash breaks entire airdrop functionality

Description:

The SnowmanAirdrop contract contains a critical typo in the MESSAGE_TYPEHASH constant. The type signature incorrectly specifies "addres" instead of "address" in the string "SnowmanClaim(addres receiver, uint256 amount)". This malformed typehash breaks the EIP-712 signature verification mechanism, rendering the entire airdrop contract non-functional.

EIP-712 requires exact string matching for type signatures when computing domain separators and message hashes. The incorrect typehash generates a completely different hash value than what client-side applications would produce when creating signatures with the correct "address" type, causing all signature validation attempts to fail.

Attack path:

  1. User attempts to claim Snowman NFT by calling claimSnowman() with valid Merkle proof and signature

  2. Contract calls getMessageHash() which uses the malformed MESSAGE_TYPEHASH containing "addres"

  3. The computed message hash differs from the hash used to generate the user's signature (which correctly uses "address")

  4. _isValidSignature() fails to recover the correct signer address from the signature

  5. Transaction reverts with SA__InvalidSignature() error

  6. No legitimate user can successfully claim their airdrop, regardless of having valid proofs and signatures

Impact:

The entire airdrop mechanism is non-functional

Recommended Mitigation:

Fix the typo in SnowmanAirdrop.sol:

// Current (broken):
bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)");
// Fixed:
bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(address receiver, uint256 amount)");
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inconsistent MESSAGE_TYPEHASH with standard EIP-712 declaration

A typo in the `MESSAGE_TYPEHASH` variable of the `SnowmanAirdrop` contract will prevent signature verification claims. Used `addres` instead of `address`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.