AirDropper

Root + Impact

The contract gives the owner exactly one recovery path: claimFees(), which withdraws ETH claim fees. There is no function to withdraw or sweep the airdrop token itself. Any USDC that is not claimed, because an eligible user lost their key, never bothers, or (as in the Deploy script mismatch) cannot claim at all, is permanently locked in the contract. For a fixed, one-shot distribution to four known addresses this is a realistic outcome, not a theoretical one.

Description

Risk

Likelihood: Medium - only needs one of four eligible users to never claim, over an unlimited claim window with no deadline.
Impact: Low - funds are locked rather than stolen; the amount at risk is the unclaimed remainder (up to 25 USDC per inactive user).

Proof of Concept

Code review plus the Finding 2 scenario: fund the contract, have only some users claim, and observe there is no callable function by which the owner can retrieve the remaining token balance (the only owner function moves ETH, not the airdrop token).

Recommended Mitigation

Add an owner sweep for the airdrop token that activates after a claim deadline, so undistributed funds return to the owner once the distribution is over: