Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

No deadline included in signed message

0xtona

Root cause

In ERC712, the deadline mitigates the risk where a relaying party receives a signed message but waits to submit it on-chain at an opportune moment. Without a deadline, someone holding your signature could wait indefinitely to execute it when conditions are most favorable to them

The typed data struct omits an expiration timestamp (deadline), so signatures never naturally expire on-chain.

bytes32 private constant MESSAGE_TYPEHASH =
keccak256("SnowmanClaim(addres receiver, uint256 amount)");
​
function claimSnowman(
address receiver,
bytes32[] calldata merkleProof,
uint8 v,
bytes32 r,
bytes32 s
) {
// ...
}

Impact

valid signed claims can be used long after user's intended window.

Likelihood

Depends on off-chain signing and operational controls.

Mitigation

Include a uint256 deadline field in the signed struct or paramters of claimSnowman()

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!