Submission Details
Impact:
Likelihood:
The claim function allows any address to claim tokens on behalf of another account.
The claim function allows any address to submit a valid Merkle proof and claim tokens on behalf of another account. While the tokens are safely transferred to the correct account, the lack of msg.sender validation means third parties can force claims for other users. This might be intentional, but if not, it could lead to unexpected claim executions.
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.