Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Merkle leaf and EIP-712 signature are built from the live, mutable `Snow` balance instead of the fixed snapshot amount, permanently locking active users out of their Snowman claim

memegod81

Root + Impact: Merkle leaf and EIP-712 signature are built from the live, mutable `Snow` balance instead of the fixed snapshot amount, permanently locking active users out of their Snowman claim

Description

  • **Description:** `claimSnowman()` and `getMessageHash()` both derive `amount` from `i_snow.balanceOf(receiver)` — the user's **current, live** SNOW balance at the moment the function is called: ```solidity uint256 amount = i_snow.balanceOf(receiver); bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); ``` ```solidity function getMessageHash(address receiver) public view returns (bytes32) { uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); } ``` However, both the Merkle tree (`i_merkleRoot`) and the EIP-712 signature the `receiver` originally produced were generated using a **fixed snapshot amount** — the user's balance at the time the airdrop list/signature was created, not their balance at claim time. `Snow.sol` allows any user to change their balance at any time via `buySnow()` (anytime) or `earnSnow()` (weekly) throughout the entire 12-week `FARMING_DURATION`. If a user's balance changes even slightly between the snapshot and their claim — which is the normal, expected, encouraged behavior for an active participant — both the Merkle proof verification and the signature verification will be built against the wrong `amount` and will fail.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Reason 2

Impact:

  • **Impact:** Any legitimate user who earns or buys additional `Snow` tokens after the Merkle snapshot was taken — completely normal, encouraged protocol usage — permanently loses the ability to claim their `Snowman` NFT, with no workaround, since `amount` can never be reset back to the original snapshot value. Given the 12-week farming period during which `earnSnow()`/`buySnow()` remain open, this is not an edge case: it would affect the majority of genuinely active users, while only users who stopped interacting with `Snow.sol` immediately after the snapshot would be unaffected. Notably, the more actively and legitimately a user participates in the protocol, the more likely they are to be locked out of their reward. No funds are directly stolen, which is why this is rated High rather than Critical.

Proof of Concept


**Proof of Concept:**
​
```solidity
function test_liveBalanceChangeBreaksClaim() public {
// Snapshot: alice had 5 Snow tokens when the Merkle tree / signature were generated.
// proof and signature (v, r, s) below are only valid for amount = 5.
​
// Alice legitimately earns more Snow after the snapshot, as intended by the protocol.
vm.prank(alice);
snow.earnSnow(); // alice's live balance is now 6, not 5
​
// Alice (or a relayer) attempts to claim using her original proof/signature (built for amount = 5)
vm.expectRevert(SnowmanAirdrop.SA__InvalidProof.selector);
airdrop.claimSnowman(alice, aliceMerkleProof, v, r, s);
​
// Alice can never successfully claim again: her live balance will never equal
// the snapshot amount the proof and signature were generated for.
}
```
​
*(Note: fill in `aliceMerkleProof`, `v`, `r`, `s` using your project's actual `SnowMerkle`/`GenerateInput` scripts, generating them for `amount = 5` at the snapshot point, before calling `earnSnow()`.)*
​

Recommended Mitigation

- remove this codePass `amount` as an explicit function parameter — supplied by the caller, matching the original snapshot value — instead of re-deriving it from live, mutable state, in **both** functions:
​
```diff
- function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
+ function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
external
nonReentrant
{
if (receiver == address(0)) { revert SA__ZeroAddress(); }
- if (i_snow.balanceOf(receiver) == 0) { revert SA__ZeroAmount(); }
+ if (amount == 0) { revert SA__ZeroAmount(); }
​
- if (!_isValidSignature(receiver, getMessageHash(receiver), v, r, s)) {
+ if (!_isValidSignature(receiver, getMessageHash(receiver, amount), v, r, s)) {
revert SA__InvalidSignature();
}
​
- uint256 amount = i_snow.balanceOf(receiver);
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
...
}
​
- function getMessageHash(address receiver) public view returns (bytes32) {
- if (i_snow.balanceOf(receiver) == 0) { revert SA__ZeroAmount(); }
- uint256 amount = i_snow.balanceOf(receiver);
+ function getMessageHash(address receiver, uint256 amount) public view returns (bytes32) {
return _hashTypedDataV4(
keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount})))
);
}
```
​
Note: `i_snow.safeTransferFrom(receiver, address(this), amount)` still correctly pulls the caller-supplied `amount`, and any mismatch between what was signed/proven and the user's actual token approval will naturally revert at the ERC20 transfer step — so this change does not introduce a new way to claim more tokens than a user actually holds.
+ add this code
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 6 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] DoS to a user trying to claim a Snowman

# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.  ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!