Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Typo in MESSAGE_TYPEHASH

smexor

Root + Impact

Description

  • Normal behavior:
    The SnowmanAirdrop contract uses EIP-712 typed data signatures to validate authorized claims. A correct MESSAGE_TYPEHASH ensures the generated hash matches the signature signed off-chain.

    Specific issue:
    There is a typo in the MESSAGE_TYPEHASH declaration: "addres" instead of "address". This results in a different hash than expected, making all legitimate EIP-712 signatures invalid, even if they were signed correctly off-chain.

@> bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)");
​

Risk

Likelihood:

  • This will always occur when users try to claim using valid off-chain signatures.

  • Off-chain tools like Ethers.js or web apps will generate correct EIP-712 signatures with "address" typed data, which will never match the on-chain hash from the incorrect "addres" string.

Impact:

  • Signature verification will fail consistently.

  • All valid claim attempts will revert with SA__InvalidSignature(), blocking users from claiming Snowman NFTs.

Proof of Concept

// This is the incorrect EIP-712 hash
bytes32 wrongHash = keccak256("SnowmanClaim(addres receiver, uint256 amount)");
​
// Off-chain signature will use this (correct) type string
bytes32 correctHash = keccak256("SnowmanClaim(address receiver, uint256 amount)");
​
// Comparison fails
assert(wrongHash != correctHash);
​

Recommended Mitigation

- bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)");
+ bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(address receiver, uint256 amount)");
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Inconsistent MESSAGE_TYPEHASH with standard EIP-712 declaration

A typo in the `MESSAGE_TYPEHASH` variable of the `SnowmanAirdrop` contract will prevent signature verification claims. Used `addres` instead of `address`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.