Submission Details
Severity:
Missing Claim Status Check allows Repeated NFT Minting
# Missing Claim Status Check allows Repeated NFT Minting
## Description
* Normally, airdrop contracts should prevent users from claiming more than once by enforcing a claim status check.
* The `SnowmanAirdrop` contract sets `s_hasClaimedSnowman[receiver] = true`, but **never checks it before minting**. This means users can repeatedly call `claimSnowman` and mint unlimited NFTs.
```solidity
function claimSnowman(...) external nonReentrant {
...
// @> s_hasClaimedSnowman is set
s_hasClaimedSnowman[receiver] = true;
i_snowman.mintSnowman(receiver, amount);
}
```
## Risk
**Likelihood**:
* Occurs every time a user reuses the same valid Merkle proof and signature without being restricted by a claim status check.
**Impact**:
* Infinite minting of Snowman NFTs.
* Loss of trust and value in the NFT collection due to uncontrolled inflation.
## Proof of Concept
See in the below example that a user can mint infinite NFT's
```solidity
// Repeated calls allow infinite NFT minting
for (uint i = 0; i < 10; i++) {
airdrop.claimSnowman(receiver, proof, v, r, s);
}
```
## Recommended Mitigation
Add a guard clause to prevent re-claiming.
```diff
function claimSnowman(...) external nonReentrant {
+ if (s_hasClaimedSnowman[receiver]) {
+ revert("Already claimed");
+ }
...
s_hasClaimedSnowman[receiver] = true;
...
}
```
Updates
Lead Judging Commences
yeahchibyke 16 days ago
Submission Judgement Published Assigned finding tags:
Lack of claim check
The claim function of the Snowman Airdrop contract doesn't check that a recipient has already claimed a Snowman. This poses no significant risk as is as farming period must have been long concluded before snapshot, creation of merkle script, and finally claiming.
Rewards breakdown
nSLOC
215This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.