Root + Impact

Description

• Normal behavior: a claim should be initiated by the eligible account itself, or permissionless meta-claiming should be an explicitly documented feature.

• The issue: claim(address account, ...) has no msg.sender == account check; the tokens go to account while the caller pays the 1e9 wei fee. A third party can trigger claims for others (paying their fees for them):

  @> function claim(address account, uint256 amount, bytes32[] calldata merkleProof)

  external

  payable

  { // no `msg.sender == account` check

  if (msg.value != CLAIM_FEE) { revert MerkleAirdrop__InvalidClaimFee(); }

  ...

  i_airdropToken.safeTransfer(account, amount);

  }

Risk

• Reason 1 // claim is callable by any address with any eligible account and a valid proof.

• Reason 2 // The 1e9 wei fee is paid by the caller's msg.value, not by the beneficiary's funds.

• Impact 1 // No direct fund loss — the tokens always land with the eligible account — but it is an unintended permissionless side effect.

• Impact 2 // A third party can force-claim for others, e.g. frontrunning the eligible user's own claim transaction.

Proof of Concept

PoC verified by a passing Foundry test (test_PoC_L1_ThirdPartyCanClaimForEligibleAccount): a stranger pays the fee and claims for collectorOne; tokens land with collectorOne.

Recommended Mitigation

Enforce msg.sender == account, or document explicitly that meta-claiming is intended: