Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Race Condition via Dynamic Amount Calculation in Merkle Proof Verification

shahparv1310

Description

Normal Behavior

The SnowmanAirdrop contract should use fixed amounts in Merkle proof verification, ensuring that proofs remain valid regardless of timing or balance changes.

Issue Description

The contract dynamically calculates the claim amount using i_snow.balanceOf(receiver) at verification time, creating race conditions where balance changes invalidate previously valid Merkle proofs.

Root + Impact

Description

The contract uses real-time balance calculation instead of fixed amounts, making Merkle proofs time-sensitive and prone to invalidation from normal token operations.

Root Cause

// @> Dynamic amount calculation creates race condition
function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
external
nonReentrant
{
// ... validation logic ...
uint256 amount = i_snow.balanceOf(receiver); // @> Dynamic amount at claim time
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
// @> Proof was likely created with different amount
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert SA__InvalidProof();
}
}

The getMessageHash() function also uses this same dynamic amount calculation 2 , compounding the issue.

Risk

Likelihood:

  • Reason 1: Users can acquire additional Snow tokens through earnSnow() or buySnow() between proof generation and claim

  • Reason 2: The amount calculation happens at claim time, not proof generation time

Impact:

  • Impact 1: Valid Merkle proofs become invalid due to normal token operations

  • Impact 2: Users lose access to legitimate claims due to timing issues

  • Impact 3: Poor user experience and potential loss of funds

Proof of Concept

function testRaceConditionMerkleProof() public {
// Setup: User has 1 Snow token
vm.prank(alice);
snow.transfer(alice, 1);
// Generate Merkle proof based on current balance (1 token)
bytes32[] memory proof = generateMerkleProof(alice, 1);
bytes32 digest = airdrop.getMessageHash(alice);
(uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, digest);
// User earns additional token before claiming
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
snow.earnSnow(); // Now has 2 tokens
// Claim fails because proof was for 1 token, but balance is now 2
vm.prank(alice);
vm.expectRevert(SnowmanAirdrop.SA__InvalidProof.selector);
airdrop.claimSnowman(alice, proof, v, r, s);
}

Recommended Mitigation

function claimSnowman(
address receiver,
uint256 amount, // @> Add amount parameter
bytes32[] calldata merkleProof,
uint8 v, bytes32 r, bytes32 s
) external nonReentrant {
if (receiver == address(0)) {
revert SA__ZeroAddress();
}
- if (i_snow.balanceOf(receiver) == 0) {
- revert SA__ZeroAmount();
- }
+ require(amount > 0, "Invalid amount");
+ require(i_snow.balanceOf(receiver) >= amount, "Insufficient balance");
​
if (!_isValidSignature(receiver, getMessageHash(receiver, amount), v, r, s)) {
revert SA__InvalidSignature();
}
​
- uint256 amount = i_snow.balanceOf(receiver);
-
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
// ... rest of function ...
}

Also update getMessageHash() to accept amount parameter:

- function getMessageHash(address receiver) public view returns (bytes32) {
+ function getMessageHash(address receiver, uint256 amount) public view returns (bytes32) {
- if (i_snow.balanceOf(receiver) == 0) {
- revert SA__ZeroAmount();
- }
-
- uint256 amount = i_snow.balanceOf(receiver);
​
return _hashTypedDataV4(
keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount})))
);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] DoS to a user trying to claim a Snowman

# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.  ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!