Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Dynamic Balance in Merkle Verification Causes Claim Failures

vikramgoutham289

Root + Impact

Using i_snow.balanceOf(receiver) instead of a fixed airdrop amount for Merkle leaf construction causes verification failures when user's current balance differs from their allocation in the Merkle tree.

Description

The Merkle tree is constructed off-chain with predetermined (receiver, amount) pairs representing each user's airdrop allocation. The claimSnowman function should verify claims against these fixed allocations stored in the Merkle tree.

The function uses i_snow.balanceOf(receiver) to determine the amount for Merkle leaf construction, which changes dynamically as users buy, sell, or transfer tokens. This causes the computed leaf to differ from the original leaf in the Merkle tree.

// SnowmanAirdrop.sol
function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
external
nonReentrant
{
// ...
// @> Uses current balance instead of predetermined airdrop amount
uint256 amount = i_snow.balanceOf(receiver);
​
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
​
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert SA__InvalidProof();
}
// ...
}

Risk

Likelihood:HIGH

  • Reason 1 :Any user who buys additional Snow tokens after the Merkle tree is generated will fail verification

  • Reason 2:Any user who transfers or sells any Snow tokens will fail verification

Impact:HIGH

  • Impact 1:Legitimate airdrop recipients cannot claim their Snowman NFTs

  • Impact 2:Users must maintain exact token balance from snapshot time until claim, which is impractical

Proof of Concept

This test demonstrates that after Alice purchases additional tokens, her current balance no longer matches her Merkle tree allocation. The leaf computed with her new balance produces a different hash, causing Merkle verification to fail even though she is a legitimate airdrop recipient.

function testMerkleVerificationFailsAfterBalanceChange() public {
address alice = makeAddr("alice");
uint256 originalAmount = 100;
// Alice buys 50 more tokens
vm.prank(alice);
snow.buySnow{value: 50 * buyFee}(50);
// Alice now has 150 tokens, but Merkle tree expects 100
vm.prank(alice);
vm.expectRevert(SnowmanAirdrop.SA__InvalidProof.selector);
airdrop.claimSnowman(alice, merkleProof, v, r, s);
}

Recommended Mitigation

Pass the airdrop amount as a function parameter instead of reading current balance. This allows the Merkle verification to use the original allocation amount from the tree, then separately validate the user has sufficient balance to stake.

function claimSnowman(
address receiver,
+ uint256 amount,
bytes32[] calldata merkleProof,
uint8 v,
bytes32 r,
bytes32 s
) external nonReentrant {
if (receiver == address(0)) {
revert SA__ZeroAddress();
}
- if (i_snow.balanceOf(receiver) == 0) {
+ if (amount == 0) {
revert SA__ZeroAmount();
}
​
- if (!_isValidSignature(receiver, getMessageHash(receiver), v, r, s)) {
+ if (!_isValidSignature(receiver, getMessageHash(receiver, amount), v, r, s)) {
revert SA__InvalidSignature();
}
​
- uint256 amount = i_snow.balanceOf(receiver);
​
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
​
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert SA__InvalidProof();
}
​
+ if (i_snow.balanceOf(receiver) < amount) {
+ revert SA__InsufficientBalance();
+ }
​
i_snow.safeTransferFrom(receiver, address(this), amount);
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 7 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] DoS to a user trying to claim a Snowman

# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.&#x20; ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!