Root + Impact

Description

Normal behavior:
Merkle tree input data should be generated based on transparent, verifiable sources — ideally on-chain events or snapshots — and should reflect eligibility in a deterministic and auditable manner.

The problem:

There is no documentation explaining how these addresses were selected, how the amounts were calculated, or whether any eligibility criteria like stake, activity, time were applied. Since this file is used directly as the source for Merkle leaf generation, this results in a system that:

• Cannot be reproduced or validated by end users

• Allows hidden Sybil insertions

• Relies on full trust in whoever created the file

This input.json file hardcodes addresses and token amounts like this:

Risk

Likelihood: Medium

• This occurs every time input.json is used to generate a Merkle tree. If the file was created manually or without on-chain traceability, it's impossible to confirm fairness or prevent gaming.

• When a malicious actor gets control over this file, they could insert Sybil wallets or inflate token amounts with no user knowing — since there’s no on-chain enforcement or audit trail validating the content.

Impact: Medium

• Airdrop recipients may include Sybil wallets or arbitrary participants, damaging the fairness and decentralization of the Snowman distribution.

• Users cannot verify their eligibility or audit the airdrop source, reducing transparency and potentially eroding trust in the protocol.

  
  

Proof of Concept

There is:

• No reference to where these addresses came from

• No timestamp, snapshot block, or user eligibility info

• No cryptographic guarantee this file hasn't been tampered with

Any developer could silently insert fake addresses and generate a valid Merkle root.

Recommended Mitigation

The airdrop input file should not be manually crafted or opaque. Instead, inputs should be:

• Deterministically derived from known sources (staking history, balances, off-chain CSVs)

• Publicly documented, with clear inclusion logic

• Reproducible by the community, ideally with a Git commit or hash fingerprint of the snapshot

This improves fairness, security, and decentralization of the Merkle airdrop process.