Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Dead storage variable s_claimers declared and documented but never written or read in SnowmanAirdrop

verdoolaegelouis

Description

SnowmanAirdrop.sol:42 declares address[] private s_claimers with the inline comment // array to store addresses of claimers, but no code path in the contract reads or writes to this array. The storage slot is reserved at deployment and never used.

// src/SnowmanAirdrop.sol:42
address[] private s_claimers; // @> documented but unused — never read or written

Combined with s_hasClaimedSnowman being set but never read (separate finding), the contract has two distinct claim-tracking facilities and neither is functionally used to prevent double-claims. A future developer reading the contract may incorrectly assume s_claimers is the source-of-truth for who has claimed, leading to a downstream bug.

Risk

Code-quality and maintenance risk only. No direct fund loss. However, the unused storage slot slightly increases deployment cost, and the misleading variable name creates confusion for anyone reviewing or extending the contract.

Proof of Concept

The variable is declared at line 42 but searching the entire contract reveals zero reads and zero writes to s_claimers outside the declaration itself.

address[] private s_claimers; // declared here
// grep result: no push(), no s_claimers[i], no s_claimers.length anywhere in the contract

Recommended Mitigation

Either remove the declaration entirely, or populate it inside claimSnowman if off-chain enumeration is needed:

- address[] private s_claimers;
​
// OR if tracking is desired:
function claimSnowman(...) external nonReentrant {
...
+ s_claimers.push(receiver);
s_hasClaimedSnowman[receiver] = true;
...
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!