Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Airdrop amount is read from live `balanceOf` instead of the Merkle snapshot, locking out any receiver whose balance changed

codebycinar

Description

Normal behavior: a receiver in the Merkle tree for a snapshot amount should be able to claim their Snowman NFTs.

Specific issue: claimSnowman computes amount = i_snow.balanceOf(receiver) at call time and builds the leaf as keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))). The Merkle root, however, was generated from fixed snapshot amounts. Any receiver whose Snow balance changed after the snapshot (earning the free weekly Snow, buying more, or transferring some out) produces a leaf that no longer matches the root, so MerkleProof.verify fails and the claim reverts. Legitimate users are permanently locked out through ordinary token activity.

uint256 amount = i_snow.balanceOf(receiver); // @> live balance, not snapshot
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) revert SA__InvalidProof();

Risk

Likelihood:

  • Snow is explicitly designed to be earned weekly and bought; any such action changes balanceOf and breaks the proof.

Impact:

  • Denial of the airdrop for affected receivers; a core protocol function becomes unusable for anyone who touches their balance.

Proof of Concept

The test gives bob a valid proof for his snapshot amount, then has him earn a single unit of Snow (an action the protocol explicitly offers). His live balance is now snapshot+1, so the leaf recomputed inside claimSnowman no longer matches the root, and the call reverts with SA__InvalidProof. This shows normal, intended token activity permanently blocks a legitimate claim.

function test_ClaimRevertsAfterBalanceChanges() public {
vm.prank(bob); snow.earnSnow(); // balance now snapshot+1
vm.prank(bob); snow.approve(address(airdrop), type(uint256).max);
vm.expectRevert(SnowmanAirdrop.SA__InvalidProof.selector);
airdrop.claimSnowman(bob, proofForSnapshot, v, r, s); // legit receiver locked out
}

Recommended Mitigation

Treat the snapshot amount as authoritative rather than the live balance: pass amount in as a parameter, use it for both the leaf and the staking transfer, and bind the signature to that same amount. The claim then depends only on immutable snapshot data, so ordinary balance changes cannot invalidate a valid proof.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] DoS to a user trying to claim a Snowman

# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.  ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!