Root + Impact

Description

• MerkleAirdrop is intended to emit events to allow off-chain systems and integrators to track meaningful state changes.

The contract declares MerkleRootUpdated but i_merkleRoot is immutable — it can only be set in the constructor and can never change after deployment. There is no setter function anywhere in the contract. The event therefore can never be emitted under any circumstances. It is dead code that signals a capability the contract does not have.

Risk

Likelihood:

• This does not affect runtime behavior — no funds are at risk and no execution path is broken

Impact:

• Off-chain integrators or monitoring tools that listen for MerkleRootUpdated will never receive it, potentially causing silent failures in downstream systems

The presence of the event implies the Merkle root is updatable, which could mislead auditors or users into believing the owner can silently swap the root to redirect funds — a trust concern even if not currently exploitable

• Wasted bytecode increases deployment gas cost marginally

Proof of Concept

This is statically verifiable from the source — no test is required. A search for all emit statements in the contract confirms MerkleRootUpdated is never referenced outside its declaration:

Recommended Mitigation

Either remove the event entirely, or replace immutable with a private variable, add an owner-only setter, and emit the event correctly. The first option is preferred given the current design intent of a fixed-root airdrop.