Submission Details
Severity:
Unconsistent `MESSAGE_TYPEHASH` with standart EIP-712 declaration on contract `SnowmanAirdrop`
Root + Impact
Description
Little typo on
MESSAGE_TYPEHASHDeclaration onSnowmanAirdropcontract
// src/SnowmanAirdrop.sol
49: bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)");
Impact:
function claimSnowmannever beTRUEcondition
Proof of Concept
Applying this function at the end of /test/TestSnowmanAirdrop.t.sol to know what the correct and wrong digest output HASH.
Ran with command: forge test --match-test testFrontendSignatureVerification -vvvv
function testFrontendSignatureVerification() public {
// Setup Alice for the test
vm.startPrank(alice);
snow.approve(address(airdrop), 1);
vm.stopPrank();
// Simulate frontend using the correct format
bytes32 FRONTEND_MESSAGE_TYPEHASH = keccak256("SnowmanClaim(address receiver, uint256 amount)");
// Domain separator used by frontend (per EIP-712)
bytes32 DOMAIN_SEPARATOR = keccak256(
abi.encode(
keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
keccak256("Snowman Airdrop"),
keccak256("1"),
block.chainid,
address(airdrop)
)
);
// Get Alice's token amount
uint256 amount = snow.balanceOf(alice);
// Frontend creates hash using the correct format
bytes32 structHash = keccak256(
abi.encode(
FRONTEND_MESSAGE_TYPEHASH,
alice,
amount
)
);
// Frontend creates the final digest (per EIP-712)
bytes32 frontendDigest = keccak256(
abi.encodePacked(
"\x19\x01",
DOMAIN_SEPARATOR,
structHash
)
);
// Alice signs the digest created by the frontend
(uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, frontendDigest);
// Digest created by the contract (with typo)
bytes32 contractDigest = airdrop.getMessageHash(alice);
// Display both digests for comparison
console2.log("Frontend Digest (correct format):");
console2.logBytes32(frontendDigest);
console2.log("Contract Digest (with typo):");
console2.logBytes32(contractDigest);
// Compare the digests - they should differ due to the typo
assertFalse(
frontendDigest == contractDigest,
"Digests should differ due to typo in MESSAGE_TYPEHASH"
);
// Attempt to claim with the signature - should fail
vm.prank(satoshi);
vm.expectRevert(SnowmanAirdrop.SA__InvalidSignature.selector);
airdrop.claimSnowman(alice, AL_PROOF, v, r, s);
assertEq(nft.balanceOf(alice), 0);
}
Recommended Mitigation
on contract SnowmanAirdrop Line 49 applying this:
- bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)");
+ bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(address receiver, uint256 amount)");
Updates
Lead Judging Commences
yeahchibyke 20 days ago
Submission Judgement Published Assigned finding tags:
Inconsistent MESSAGE_TYPEHASH with standard EIP-712 declaration
A typo in the `MESSAGE_TYPEHASH` variable of the `SnowmanAirdrop` contract will prevent signature verification claims. Used `addres` instead of `address`
Rewards breakdown
nSLOC
215This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.