Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`claimSnowman` never checks `s_hasClaimedSnowman` and signatures carry no nonce, so one Merkle allocation can be claimed repeatedly by replay

zodmastro

Root + Impact

Description

  • The Merkle tree is meant to cap each whitelisted address at one allocation, and the contract keeps an s_hasClaimedSnowman mapping plus a getClaimStatus getter for exactly that purpose.

  • The flag is written but never read, and the signed message holds only (receiver, amount) with no nonce or deadline. Once a claimed address returns to its snapshot balance, the original proof and signature validate again, and anyone holding that signature can replay it.

s_hasClaimedSnowman[receiver] = true; //@> written here, never checked at the top of claimSnowman

Risk

Likelihood:

  • Returning to the snapshot balance is trivial and expected: a whitelisted address just calls earnSnow again, since every published allocation is 1 wei.

  • Signatures are visible in calldata as soon as a claim is broadcast, so any observer can capture and re-use one, and the replay can be sent by any address.

Impact:

  • The Merkle allocation cap is broken: a whitelisted address can mint more NFTs than the tree grants it, once per re-acquisition, for as long as it keeps re-acquiring Snow, inflating distribution unfairly against other recipients.

  • Since a third party can execute the replay, a recipient's later-acquired Snow can be force-staked into the airdrop without their consent whenever an allowance is still open, which is the normal state after a max approval.

Proof of Concept

Save as test/Sub4.t.sol and run forge test --match-path test/Sub4.t.sol -vv. Alice claims her single allocation, earns Snow again a week later, and an unrelated attacker replays her original proof and signature, leaving her with 2 NFTs for an allocation of 1.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
​
import {Test} from "forge-std/Test.sol";
import {Snow} from "../src/Snow.sol";
import {Snowman} from "../src/Snowman.sol";
import {SnowmanAirdrop} from "../src/SnowmanAirdrop.sol";
import {MockWETH} from "../src/mock/MockWETH.sol";
import {Helper} from "../script/Helper.s.sol";
​
contract Sub4ReplayClaim is Test {
Snow snow;
Snowman nft;
SnowmanAirdrop airdrop;
MockWETH weth;
​
address alice;
uint256 alKey;
address attacker = makeAddr("attacker");
​
bytes32[] AL_PROOF = [
bytes32(0xf99782cec890699d4947528f9884acaca174602bb028a66d0870534acf241c52),
bytes32(0xbc5a8a0aad4a65155abf53bb707aa6d66b11b220ecb672f7832c05613dba82af),
bytes32(0x971653456742d62534a5d7594745c292dda6a75c69c43a6a6249523f26e0cac1)
];
​
function setUp() public {
Helper helper = new Helper();
(airdrop, snow, nft, weth) = helper.run();
(alice, alKey) = makeAddrAndKey("alice");
}
​
function test_SameAllocationClaimedTwiceByReplay() public {
vm.prank(alice);
snow.approve(address(airdrop), type(uint256).max);
​
(uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, airdrop.getMessageHash(alice));
​
// First, legitimate claim of an allocation of 1.
airdrop.claimSnowman(alice, AL_PROOF, v, r, s);
assertEq(nft.balanceOf(alice), 1);
assertTrue(airdrop.getClaimStatus(alice)); // flag set but never enforced
​
// Alice earns Snow again, returning to her snapshot balance.
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
snow.earnSnow();
​
// An unrelated third party replays the captured proof and signature.
vm.prank(attacker);
airdrop.claimSnowman(alice, AL_PROOF, v, r, s);
​
assertEq(nft.balanceOf(alice), 2); // allocation of 1 claimed twice
}
}

Output:

Ran 1 test for test/Sub4.t.sol:Sub4ReplayClaim
[PASS] test_SameAllocationClaimedTwiceByReplay() (gas: 342367)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 8.81ms (865.04µs CPU time)

Recommended Mitigation

Enforce the flag, and bind signatures to a nonce and a deadline.

+ error SA__AlreadyClaimed();
+
function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
external
nonReentrant
{
+ if (s_hasClaimedSnowman[receiver]) revert SA__AlreadyClaimed();
if (receiver == address(0)) revert SA__ZeroAddress();

Also add a per-receiver nonce and a deadline to the SnowmanClaim struct and to MESSAGE_TYPEHASH, incrementing the nonce on every successful claim.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[L-01] Missing Claim Status Check Allows Multiple Claims in SnowmanAirdrop.sol::claimSnowman

# Root + Impact   **Root:** The [`claimSnowman`](https://github.com/CodeHawks-Contests/2025-06-snowman-merkle-airdrop/blob/b63f391444e69240f176a14a577c78cb85e4cf71/src/SnowmanAirdrop.sol#L44) function updates `s_hasClaimedSnowman[receiver] = true` but never checks if the user has already claimed before processing the claim, allowing users to claim multiple times if they acquire more Snow tokens. **Impact:** Users can bypass the intended one-time airdrop limit by claiming, acquiring more Snow tokens, and claiming again, breaking the airdrop distribution model and allowing unlimited NFT minting for eligible users. ## Description * **Normal Behavior:** Airdrop mechanisms should enforce one claim per eligible user to ensure fair distribution and prevent abuse of the reward system. * **Specific Issue:** The function sets the claim status to true after processing but never validates if `s_hasClaimedSnowman[receiver]` is already true at the beginning, allowing users to claim multiple times as long as they have Snow tokens and valid proofs. ## Risk **Likelihood**: Medium * Users need to acquire additional Snow tokens between claims, which requires time and effort * Users must maintain their merkle proof validity across multiple claims * Attack requires understanding of the missing validation check **Impact**: High * **Airdrop Abuse**: Users can claim far more NFTs than intended by the distribution mechanism * **Unfair Distribution**: Some users receive multiple rewards while others may receive none * **Economic Manipulation**: Breaks the intended scarcity and distribution model of the NFT collection ## Proof of Concept Add the following test to TestSnowMan.t.sol  ```Solidity function testMultipleClaimsAllowed() public { // Alice claims her first NFT vm.prank(alice); snow.approve(address(airdrop), 1); bytes32 aliceDigest = airdrop.getMessageHash(alice); (uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, aliceDigest); vm.prank(alice); airdrop.claimSnowman(alice, AL_PROOF, v, r, s); assert(nft.balanceOf(alice) == 1); assert(airdrop.getClaimStatus(alice) == true); // Alice acquires more Snow tokens (wait for timer and earn again) vm.warp(block.timestamp + 1 weeks); vm.prank(alice); snow.earnSnow(); // Alice can claim AGAIN with new Snow tokens! vm.prank(alice); snow.approve(address(airdrop), 1); bytes32 aliceDigest2 = airdrop.getMessageHash(alice); (uint8 v2, bytes32 r2, bytes32 s2) = vm.sign(alKey, aliceDigest2); vm.prank(alice); airdrop.claimSnowman(alice, AL_PROOF, v2, r2, s2); // Second claim succeeds! assert(nft.balanceOf(alice) == 2); // Alice now has 2 NFTs } ``` ## Recommended Mitigation **Add a claim status check at the beginning of the function** to prevent users from claiming multiple times. ```diff // Add new error + error SA__AlreadyClaimed(); function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { + if (s_hasClaimedSnowman[receiver]) { + revert SA__AlreadyClaimed(); + } + if (receiver == address(0)) { revert SA__ZeroAddress(); } // Rest of function logic... s_hasClaimedSnowman[receiver] = true; } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!