Snowman Merkle Airdrop

AI First Flight #10

Beginner FriendlyFoundrySolidityNFT

EXP

View results

Previous Next

Submission Details

Severity: low

Valid

Claim Status Never Checked (Logic Bug)

sharthak18

Root + Impact

Description

The s_hasClaimedSnowman mapping is set but never checked before minting.

mapping(address => bool) private s_hasClaimedSnowman;

function claimSnowman(...) external {

@> // Missing: if (s_hasClaimedSnowman[receiver]) revert AlreadyClaimed();

// ... validation ...

s_hasClaimedSnowman[receiver] = true; // Set but never checked!

i_snowman.mintSnowman(receiver, 1);

}

Risk

Likelihood:

During the NFT mint and claim

Impact:

Users can claim multiple times; mapping serves no purpose

Proof of Concept

Create a file inside the test folder and paste the code

This code prove that user can claim multiple time

// SPDX-License-Identifier: MIT

pragma solidity 0.8.24;

import {Test, console} from "forge-std/Test.sol";

import {Snow} from "../src/Snow.sol";

import {Snowman} from "../src/Snowman.sol";

import {SnowmanAirdrop} from "../src/SnowmanAirdrop.sol";

import {DeploySnow} from "../script/DeploySnow.s.sol";

import {MockWETH} from "../src/mock/MockWETH.sol";

contract AllVulnerabilitiesPoC is Test {

// Snow.sol contracts

Snow snow;

DeploySnow deployer;

MockWETH weth;

address collector;

uint256 FEE;

// Snowman.sol and SnowmanAirdrop.sol contracts

Snowman snowman;

SnowmanAirdrop airdrop;

bytes32 merkleRoot = bytes32(0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef);

// Test addresses

address alice;

address bob;

address charlie;

address attacker;

function setUp() public {

// Deploy Snow.sol contracts

deployer = new DeploySnow();

snow = deployer.run();

weth = deployer.weth();

collector = deployer.collector();

FEE = deployer.FEE();

// Deploy Snowman.sol and SnowmanAirdrop.sol contracts

snowman = new Snowman("ipfs://snowman");

airdrop = new SnowmanAirdrop(merkleRoot, address(snow), address(snowman));

// Create test addresses

alice = makeAddr("alice");

bob = makeAddr("bob");

charlie = makeAddr("charlie");

attacker = makeAddr("attacker");

// Fund users

deal(alice, 100 ether);

deal(bob, 100 ether);

deal(charlie, 100 ether);

deal(attacker, 100 ether);

weth.mint(alice, 100 * FEE);

weth.mint(bob, 100 * FEE);

weth.mint(charlie, 100 * FEE);

weth.mint(attacker, 100 * FEE);

}

/// @notice HIGH: s_hasClaimedSnowman is set but never checked

function test_Airdrop_ClaimStatusNotChecked() public {

// PROOF: Look at SnowmanAirdrop.sol line 95:

// s_hasClaimedSnowman[receiver] = true;

// But there's NO check like:

// if (s_hasClaimedSnowman[receiver]) revert AlreadyClaimed();

// This means:

// 1. The mapping is written to (costs gas)

// 2. But it's NEVER read/checked before claiming

// 3. The mapping serves NO purpose - dead code

// 4. Users could potentially claim multiple times (if they can pass other checks)

bool claimStatus = airdrop.getClaimStatus(alice);

assertEq(claimStatus, false); // Not claimed yet

// After a claim, it would be set to true

// But claimSnowman() never checks this before processing!

console.log("Claim status mapping is SET but NEVER CHECKED - logic bug!");

}}

Recommended Mitigation

Checking for claimedsnowman would solve the issue

function claimSnowman(...) external {

if (s_hasClaimedSnowman[receiver]) revert AlreadyClaimed();

// ... rest of validation ...

s_hasClaimedSnowman[receiver] = true;

i_snowman.mintSnowman(receiver, 1);

}

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 6 hours ago

Submission Judgement Published

Validated

Assigned finding tags:

[L-01] Missing Claim Status Check Allows Multiple Claims in SnowmanAirdrop.sol::claimSnowman

# Root + Impact   **Root:** The [`claimSnowman`](https://github.com/CodeHawks-Contests/2025-06-snowman-merkle-airdrop/blob/b63f391444e69240f176a14a577c78cb85e4cf71/src/SnowmanAirdrop.sol#L44) function updates `s_hasClaimedSnowman[receiver] = true` but never checks if the user has already claimed before processing the claim, allowing users to claim multiple times if they acquire more Snow tokens. **Impact:** Users can bypass the intended one-time airdrop limit by claiming, acquiring more Snow tokens, and claiming again, breaking the airdrop distribution model and allowing unlimited NFT minting for eligible users. ## Description * **Normal Behavior:** Airdrop mechanisms should enforce one claim per eligible user to ensure fair distribution and prevent abuse of the reward system. * **Specific Issue:** The function sets the claim status to true after processing but never validates if `s_hasClaimedSnowman[receiver]` is already true at the beginning, allowing users to claim multiple times as long as they have Snow tokens and valid proofs. ## Risk **Likelihood**: Medium * Users need to acquire additional Snow tokens between claims, which requires time and effort * Users must maintain their merkle proof validity across multiple claims * Attack requires understanding of the missing validation check **Impact**: High * **Airdrop Abuse**: Users can claim far more NFTs than intended by the distribution mechanism * **Unfair Distribution**: Some users receive multiple rewards while others may receive none * **Economic Manipulation**: Breaks the intended scarcity and distribution model of the NFT collection ## Proof of Concept Add the following test to TestSnowMan.t.sol ```Solidity function testMultipleClaimsAllowed() public { // Alice claims her first NFT vm.prank(alice); snow.approve(address(airdrop), 1); bytes32 aliceDigest = airdrop.getMessageHash(alice); (uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, aliceDigest); vm.prank(alice); airdrop.claimSnowman(alice, AL_PROOF, v, r, s); assert(nft.balanceOf(alice) == 1); assert(airdrop.getClaimStatus(alice) == true); // Alice acquires more Snow tokens (wait for timer and earn again) vm.warp(block.timestamp + 1 weeks); vm.prank(alice); snow.earnSnow(); // Alice can claim AGAIN with new Snow tokens! vm.prank(alice); snow.approve(address(airdrop), 1); bytes32 aliceDigest2 = airdrop.getMessageHash(alice); (uint8 v2, bytes32 r2, bytes32 s2) = vm.sign(alKey, aliceDigest2); vm.prank(alice); airdrop.claimSnowman(alice, AL_PROOF, v2, r2, s2); // Second claim succeeds! assert(nft.balanceOf(alice) == 2); // Alice now has 2 NFTs } ``` ## Recommended Mitigation **Add a claim status check at the beginning of the function** to prevent users from claiming multiple times. ```diff // Add new error + error SA__AlreadyClaimed(); function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { + if (s_hasClaimedSnowman[receiver]) { + revert SA__AlreadyClaimed(); + } + if (receiver == address(0)) { revert SA__ZeroAddress(); } // Rest of function logic... s_hasClaimedSnowman[receiver] = true; } ```

Rewards breakdown

This contest has a flat reward structure with the following payouts:

Live

The contest is live. Earn rewards by submitting a finding.

Judging

Submissions are being reviewed by our AI judge. Results will be available in a few minutes.

View all submissions

Rewards Distribution

The contest is complete and the rewards are being distributed.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!