Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

EIP-712 MESSAGE\_TYPEHASH Typo Causing Signature Verification Failure

hyer

Root + Impact

Description

  • The MESSAGE_TYPEHASH constant is defined with a misspelled struct type string: "SnowmanClaim(addres receiver, uint256 amount)" instead of "SnowmanClaim(address receiver, uint256 amount)".

  • This typo can cause the EIP-712 typed data hash to mismatch with the intended signature scheme, potentially invalidating all signatures generated off-chain for this contract.

​
bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)"); // <== "addres" is misspelled
​

Risk

Likelihood:

  • All off-chain signatures generated using the correct struct definition "address" will fail signature verification on-chain.

  • This issue will occur whenever users or clients try to sign or verify claims using the EIP-712 domain separator and type hash.

Impact:

  • Legitimate claim signatures will be rejected, causing all claim transactions requiring signatures to fail.

  • Users will be unable to claim their Snowman NFTs through the intended signature-based flow.

Proof of Concept

// Off-chain code signing with correct "address" type
const typedData = {
types: {
SnowmanClaim: [
{ name: "receiver", type: "address" },
{ name: "amount", type: "uint256" },
],
},
primaryType: "SnowmanClaim",
domain: { name: "Snowman Airdrop", version: "1", ... },
message: { receiver: userAddress, amount: amount },
};
// This signature will NOT match the on-chain hash with the typo
​

Recommended Mitigation

- bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)");
+ bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(address receiver, uint256 amount)");
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge 5 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Inconsistent MESSAGE_TYPEHASH with standard EIP-712 declaration

A typo in the `MESSAGE_TYPEHASH` variable of the `SnowmanAirdrop` contract will prevent signature verification claims. Used `addres` instead of `address`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.