Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Missing validation in SnowmanAirdrop allows unauthorized state manipulation or replay vulnerability

khaled914ramzy

Summary

The SnowmanAirdrop contract lacks proper validation for airdrop claims, allowing potential abuse or unauthorized state interactions during the merkle root verification or distribution process.

Vulnerability Details

  1. The contract handles airdrop distribution via Merkle proofs.

  2. Inadequate input validation or missing state checks can lead to unexpected handling of claim states or reuse vectors if not strictly structured.

Impact

Unauthorized token claims or disruption of the airdrop mechanism, leading to potential loss of funds or unfair distribution to unintended participants.

Tools Used

Manual Code ReviewRisk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Reason 2

Impact:

  • Impact 1

  • Impact 2

Proof of Concept

// Missing check allows duplicate claims or invalid state transition

Recommended Mitigation

-- // missing validation
+ require(_isValid, "Invalid claim or already claimed");
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!