Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

`SnowmanAirdrop::s_claimers` is declared with a comment promising a claimer registry but is never written or read, so the contract keeps no record of who claimed

friedsocks233

Description

The contract declares storage for a list of everyone who has claimed, and the inline comment states that intent explicitly.

s_claimers is never pushed to and never read. grep -rn "s_claimers" src/ returns only the declaration. There is no getter and no enumeration anywhere, so the registry the comment describes does not exist.

// src/SnowmanAirdrop.sol
// >>> VARIABLES
@> address[] private s_claimers; // array to store addresses of claimers
// never pushed to, never read, no getter - the only occurrence in src/

Risk

Likelihood:

  • Permanently: the array is empty for the entire life of the contract.

Impact:

  • Any off-chain consumer or future upgrade that expects to enumerate claimers from storage gets an empty list. Paired with s_hasClaimedSnowman being written but never enforced, the contract's entire account of who has claimed is non-functional: one unread flag and one unwritten array.

  • Misleading dead storage: the comment documents behaviour the code does not implement.

Recommended Mitigation

Either populate it and expose it, or remove it.

- address[] private s_claimers; // array to store addresses of claimers

or, if the registry is wanted:

s_hasClaimedSnowman[receiver] = true;
+ s_claimers.push(receiver);
...
+ function getClaimers() external view returns (address[] memory) {
+ return s_claimers;
+ }
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!