Root + Impact

Description

• The contract doesn't validate that the `airdropToken` address is not zero in the constructor, and doesn't validate that `account` and `amount` are non-zero in the `claim` function. While these would likely cause reverts elsewhere, explicit validation improves code clarity and prevents edge cases.

  ### Root + Impact

  Missing input validation for critical parameters allows potentially invalid states or wasted gas.

  ```solidity

  // src/MerkleAirdrop.sol:25

  constructor(bytes32 merkleRoot, IERC20 airdropToken) Ownable(msg.sender) {

  i_merkleRoot = merkleRoot;

  i_airdropToken = airdropToken;

  }

  ```

  ```solidity

  // src/MerkleAirdrop.sol:30

  function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {

  ```

  If `airdropToken` is address(0), the contract will be deployed but all transfers will fail. If `account` is address(0) or `amount` is 0, users could waste gas on transactions that will fail or have no effect.

Risk

Likelihood:

• * Deployment could accidentally use zero address for token

  * Users could attempt to claim with zero address or zero amount

  * These edge cases may not be caught during testing

Impact:

• * Contract could be deployed in an unusable state (zero token address)

  * Users waste gas on invalid transactions

  * Poor user experience with unclear error messages

  * Potential for accidental token burns if zero address is used

Proof of Concept

Recommended Mitigation