AirDropper
AI First Flight #5
Beginner FriendlyDeFiFoundry
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Recipients may be unable to receive the airdrop on zkSync due to account abstraction (L1 EOA != zkSync account)

hopeh

Description


The airdrop is deployed on zkSync Era and targets "4 lucky addresses based on their activity on Ethereum L1" — i.e. Ethereum L1 EOA addresses are baked into the Merkle tree. On zkSync Era, native account abstraction means an address is not guaranteed to be controllable by the same private key as on Ethereum L1: the address derivation for smart accounts differs, and an EOA on L1 may correspond to no account (or a different account) under the control of that key on zkSync.


// claim pushes tokens to the hardcoded L1 `account`:
i_airdropToken.safeTransfer(account, amount); // @> `account` is an Ethereum L1 address
```
​
Because the recipient addresses are Ethereum L1 EOAs, an eligible user may be **unable to control that same address on zkSync** to call `claim` or to spend/move the received tokens. The tokens are sent to an L1-derived address that the intended recipient does not control on zkSync.
​
## Risk
​
**Likelihood: Medium**
​
- This affects any recipient whose L1 EOA address is not reproducible/controllable by them on zkSync due to account abstraction — a known cross-environment pitfall for airdrops that reuse L1 addresses on zkSync.
​
**Impact: High**
​
- Affected eligible users cannot claim and/or cannot access the tokens delivered to the L1-derived address on zkSync. Their airdrop allocation is effectively lost/locked, defeating the purpose of the distribution for those users.
​
## Proof of Concept
​
```solidity
// Recipient R is an Ethereum L1 EOA included in the Merkle tree.
// On zkSync Era, R's key does not control address R (account abstraction / different derivation).
// -> R cannot call claim as R, and tokens transferred to R on zkSync are not spendable by the intended user.
```
​
## Recommended Mitigation
​
Do not assume L1 EOA addresses are controllable on zkSync. Collect zkSync-native claim addresses (or a signature the recipient can produce on zkSync), and/or let recipients specify a `receiver` they control on zkSync when claiming:
​
```solidity
// claim(account, receiver, amount, proof): verify the leaf for `account`, require a signature from `account`,
// and send tokens to a zkSync-controlled `receiver`.
```
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 7 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-04] Unable to receive airdrop due to account abstraction

## Description The users that use account abstraction wallets have different addresses across chains for the same account. ## Vulnerability Details In the docs is said: ```javascript "Our team is looking to airdrop 100 USDC tokens on the zkSync era chain to 4 lucky addresses based on their activity on the Ethereum L1. The Ethereum addresses are: 0x20F41376c713072937eb02Be70ee1eD0D639966C 0x277D26a45Add5775F21256159F089769892CEa5B 0x0c8Ca207e27a1a8224D1b602bf856479b03319e7 0xf6dBa02C01AF48Cf926579F77C9f874Ca640D91D" ``` The user can claim his/her USDC tokens through the `MerkleAirdrop::claim` function. This function requires `account, amount and proof array`. With the help of this three arguments the merkle proof will ensure that the caller is eligible to claim. But in the generated merkle root are used the Ethereum addresses of the lucky users. But the protocol will be deployed on the zkSync era chain. If any of them uses account abstraction wallet, this lucky user will not be able to claim his/her tokens. The account abstraction wallets have different addresses in the different chains for the same account. ## Impact The users that use account abstraction wallets have different addresses on the zkSync era chain. That means these users will not be able to claim their USDC tokens, because the merkle root will require another account address (this on Ethereum). ## Recommendations Ensure that the addresses in `makeMerkle` file for the lucky users are their addresses for the zkSync era chain.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!