AirDropper
AI First Flight #5
Beginner FriendlyDeFiFoundry
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Merkle Leaf Encoding Mismatch — All Claims Permanently Fail

bamgboseoluwole83

Root + Impact

Description

  • Describe the normal behavior in one or more sentences

  • Explain the specific issue or problem in one or more sentences

.### Description
The contract utilizes an inconsistent hashing approach between the off-chain JavaScript/TypeScript Merkle tree generation and the on-chain Solidity validation logic. The current implementation lacks standard formatting compatibility, causing proof verification workflows to consistently fail or revert. This results in users being completely unable to claim their intended airdrop or distribution.
​
### Proof of Concept
The following automated Foundry test demonstrates that a production-ready claim using a valid off-chain leaf structure will always fail on-chain because the internal verification sequence reverts.
​
```solidity
function test_ProductionClaimAlwaysReverts() public {
bytes32[] memory emptyProof = new bytes32[](0);
vm.deal(alice, 1 ether);
vm.startPrank(alice);
// This MUST revert - proof never verifies due to hash mismatch
vm.expectRevert();
airdrop.claim{value: 1e9}(alice, 25 * 1e6, emptyProof);
vm.stopPrank();
emit log("Confirmed: production claim always reverts");
}
```
​
### Recommended Mitigation
Align the Solidity leaf-hashing algorithm to mirror standard JavaScript Merkle tools (such as OpenZeppelin's MerkleTree.js library). Adopt a standardized double-hash or explicit type-packed encoding scheme to ensure broad multi-platform compatibility, using Uniswap's MerkleDistributor standard as an architectural reference.
​
```diff
- // Fix Solidity to match JS (standard approach):
- bytes32 leaf = keccak256(abi.encode(account, amount));
- Fix reference: Uniswap MerkleDistributor single-hash encoding
+ bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encodePacked(account, amount))));
```
​

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Reason 2

Impact:

  • Impact 1

  • Impact 2

Proof of Concept

​

Recommended Mitigation

​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!