Assuming exact-amount delivery breaks allocations when the airdrop token is fee-on-transfer or rebasing

Description

claim() calls i_airdropToken.safeTransfer(account, amount) and assumes the recipient receives exactly amount. A fee-on-transfer or rebasing token delivers less than amount, so per-recipient accounting silently diverges from the Merkle-tree intent.

(src/MerkleAirdrop.sol:34-39)

Risk

Likelihood: Low

The vulnerability only manifests if the deployed i_airdropToken is a non-standard (fee-on-transfer or rebasing) ERC20. Most airdrops use a plain token, so this depends on a specific, less-common deployment choice.

Impact: Medium

Early claimers are under-paid relative to their leaf, the Claimed event over-reports the received amount, and the contract can run short before the final eligible recipients claim, leaving them unable to withdraw their full allocation.

Proof of Concept

With a 1% fee-on-transfer token, a recipient entitled to amount receives strictly less while the event still logs amount.

Recommended Mitigation

Document and restrict the airdrop to standard ERC20s, or measure the delivered balance delta and account on the actual received amount.