Snowman Merkle Airdrop

Description

The claimSnowman function uses ECDSA signatures but has no nonce or deadline checks.

Lines 69-79 show signature verification without nonce or deadline. Signatures can be replayed and never expire.

Risk

Likelihood: Medium — Anyone with a valid signature can replay it

Impact: Medium — Users can claim multiple times; signatures valid forever

Proof of Concept

1. User generates valid signature for their claim

2. User claims once, receives NFTs

3. User uses the SAME signature to claim again

4. Claim succeeds again (no nonce)

5. Signature remains valid forever (no deadline)

Recommended Mitigation

1. Add nonce mapping: mapping(address => uint256) public nonces

2. Add deadline parameter to function

3. Include nonce and deadline in signed message hash

4. Check block.timestamp < deadline

5. Increment nonce after each use