Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Missing Domain seperation

khushisahu26903

Root + Impact

Description

  • The SnowmanAirdrop contract verifies off-chain signatures to allow users or third parties to claim Snowman NFTs securely.

  • The signed message does not include domain-specific data such as the contract address or chain ID. This allows the same valid signature to be replayed across different contracts or chains that implement similar logic.

// Root cause: missing domain separation
// @> Message hash does not bind signature to a specific contract or chain
bytes32 digest = keccak256(abi.encode(receiver, amount));
​

Risk

Likelihood:

  • Occurs when the same signer key is reused across deployments

Occurs during contract redeployment or cross-chain usage

Impact:

  • Unauthorized NFT claims in unintended contracts

Signature misuse beyond the signer’s original intent

Proof of Concept

// The same signature generated for Contract A
// can be reused in Contract B
// because the digest does not include address(this) or chainid
​

Recommended Mitigation

- bytes32 digest = keccak256(abi.encode(receiver, amount));
+ bytes32 digest = keccak256(
+ abi.encode(
+ receiver,
+ amount,
+ address(this),
+ block.chainid
+ )
+ );
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!