Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

L-01

anierobipaschal70

Root + Impact

SNOW tokens are permanently locked in SnowmanAirdrop contract — no withdrawal or sweep function exists

Description

  • The claimSnowman() function transfers SNOW tokens from the user to the SnowmanAirdrop contract. The contract has no function to withdraw, sweep, or burn the accumulated SNOW tokens. It does not inherit Ownable or any access control that would allow an admin to recover the funds.

// SnowmanAirdrop.sol
@> i_snow.safeTransferFrom(receiver, address(this), amount); // Tokens sent to contract
​

Risk

Likelihood:

  • Every successful claim sends SNOW tokens to the contract. Over the lifetime of the protocol, significant token value accumulates.

Impact:

  • SNOW tokens are permanently locked, reducing circulating supply in an uncontrolled manner.

Proof of Concept

Explanation: This proves that the SNOW balance inside the Airdrop contract correctly increments upon claims, but the lack of an admin withdrawal function leaves these tokens permanently trapped.

function testTokensPermanentlyLocked() public {
// After a successful claim, SNOW tokens sit in the airdrop contract
uint256 airdropBalance = snow.balanceOf(address(airdrop));
assertGt(airdropBalance, 0);
// There is no function on the airdrop contract to withdraw them
}

Recommended Mitigation

Explanation: Adding a simple sweepSnow() function allows anyone to trigger the transfer of all locked SNOW tokens out of the Airdrop contract and directly to the protocol's secure fee collector wallet.

+ function sweepSnow() external {
+ uint256 balance = i_snow.balanceOf(address(this));
+ address collector = i_snow.getCollector();
+ i_snow.safeTransfer(collector, balance);
+ }
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 10 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!