Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Malformed EIP-712 typehash (`addres` plus stray whitespace) makes every signature produced by standard wallet tooling invalid, blocking the claim flow

augustwh11

MESSAGE_TYPEHASH is not a valid EIP-712 encodeType string, so the digest the contract verifies against is unreachable through any standards-compliant signer

Description

  • SnowmanAirdrop inherits OpenZeppelin's EIP712 so that claimants sign structured, human-readable typed data. The point of EIP-712 is that the wallet derives the typehash from the struct definition and arrives at the same digest the contract computes, letting the user see what they are approving.

  • The hardcoded MESSAGE_TYPEHASH string is not a valid encodeType: the type is misspelled addres and there is a stray space after the comma. Every compliant library derives a different hash, so a signature produced through normal wallet flows can never satisfy _isValidSignature.

// src/SnowmanAirdrop.sol:49
@> bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)");
// @@@@@@ @@@@@@@@@@@@@@@@@
// @> "addres" is not a Solidity type at all
// @> EIP-712 forbids whitespace after the comma

EIP-712 defines encodeType as name ‖ "(" ‖ member₁ ‖ "," ‖ member₂ ‖ … ‖ ")", with each member written as type ‖ " " ‖ name and no other whitespace, and restricts atomic types to bytes1..bytes32, uint8..uint256, int8..int256, bool and address. The string above breaks the rule twice, independently.

The canonical form and the two resulting hashes:

canonical : SnowmanClaim(address receiver,uint256 amount)
→ 0x8cc878fcc8a56748c223ca472f543dc59c856aca7a2e59b34d1c2b4ef288044d
​
contract : SnowmanClaim(addres receiver, uint256 amount)
→ 0xff59e96f4a12fdaf4e417a1440b578f822f6cb542be1a2a7c196280bec54f9ab

OpenZeppelin's own ERC20Permit, vendored in this repository, shows the correct form for comparison:

// lib/openzeppelin-contracts/contracts/token/ERC20/extensions/ERC20Permit.sol:22
keccak256("Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)");
// @> canonical type names, no whitespace after commas

The rest of the implementation is conformant — rebuilding the digest with the malformed typehash and a flat abi.encode(typehash, receiver, amount) reproduces getMessageHash() byte for byte, which isolates the encodeType string as the sole deviation.

Verified against the actual libraries rather than assumed:

  • ethers v6 TypedDataEncoder throws unknown type "addres".

  • viem hashTypedData throws Type "addres" is not a valid encoding type.

Even a library that tolerated the typo would emit no space after the comma, so it would still produce a different hash.

Risk

Likelihood:

  • Every attempt to sign this struct through eth_signTypedData_v4 — the standard path used by MetaMask, ethers and viem — fails outright, because the libraries reject the type string before a signature is ever produced. The failure is deterministic, not probabilistic.

  • Every claim goes through this check. claimSnowman demands a valid signature unconditionally at src/SnowmanAirdrop.sol:80, including when the receiver claims for themselves, so there is no path around it.

  • Falling back to personal_sign also fails, because it applies the EIP-191 prefix and yields a different digest again. eth_sign, which would work, is disabled by default in MetaMask and deprecated.

Impact:

  • The "have someone claim on your behalf" flow described in the README is unusable through normal wallet tooling, and a default-configuration MetaMask user cannot complete a claim at all.

  • The only remaining workaround is to have the user sign the raw hash returned by getMessageHash() — precisely the blind-signing pattern users are trained to refuse, since nothing on screen describes what is being authorised.

  • Because addres is not a type, wallets cannot render the struct meaningfully even in principle, so the human-readable guarantee EIP-712 exists to provide is lost.

Honest limitation

Stated so the severity is not overread: no assets are at risk and no unauthorised action is enabled by this. getMessageHash() is public view (src/SnowmanAirdrop.sol:112), so the correct digest is obtainable on-chain and can be signed by a script or a hardware-wallet tool. That bounded impact is why I have set Impact to Low; the deterministic failure across every standard client is why Likelihood is High. A judge who considers a broken primary user flow to be Medium impact would land this one tier higher, and I would not argue against that.

Proof of Concept

Save as test/PoCM02.t.sol and run forge test --match-contract PoCM02 -vv. The test builds the digest exactly as a compliant client would, using the contract's own domain from ERC-5267, and shows it is rejected.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
​
import {Test} from "forge-std/Test.sol";
import {Snow} from "../src/Snow.sol";
import {Snowman} from "../src/Snowman.sol";
import {SnowmanAirdrop} from "../src/SnowmanAirdrop.sol";
import {MockWETH} from "../src/mock/MockWETH.sol";
import {Helper} from "../script/Helper.s.sol";
​
contract PoCM02 is Test {
Snow snow;
Snowman nft;
SnowmanAirdrop airdrop;
MockWETH weth;
Helper deployer;
​
// alice's proof, lifted verbatim from the project's own TestSnowmanAirdrop.t.sol
bytes32[] AL_PROOF = [
bytes32(0xf99782cec890699d4947528f9884acaca174602bb028a66d0870534acf241c52),
bytes32(0xbc5a8a0aad4a65155abf53bb707aa6d66b11b220ecb672f7832c05613dba82af),
bytes32(0x971653456742d62534a5d7594745c292dda6a75c69c43a6a6249523f26e0cac1)
];
​
address alice;
uint256 alKey;
​
function setUp() public {
deployer = new Helper();
(airdrop, snow, nft, weth) = deployer.run();
(alice, alKey) = makeAddrAndKey("alice");
}
​
function test_M02_CanonicalEip712SignatureIsRejected() public {
// the hashes differ, and the canonical one is what every wallet derives
assertEq(
keccak256("SnowmanClaim(address receiver,uint256 amount)"),
0x8cc878fcc8a56748c223ca472f543dc59c856aca7a2e59b34d1c2b4ef288044d
);
assertEq(
keccak256("SnowmanClaim(addres receiver, uint256 amount)"),
0xff59e96f4a12fdaf4e417a1440b578f822f6cb542be1a2a7c196280bec54f9ab
);
​
(, string memory name_, string memory version_, uint256 chainId_, address verifying_,,) =
airdrop.eip712Domain();
​
bytes32 domainSeparator = keccak256(
abi.encode(
keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
keccak256(bytes(name_)),
keccak256(bytes(version_)),
chainId_,
verifying_
)
);
​
// exactly what MetaMask / ethers / viem would produce from the struct definition
bytes32 canonicalTypehash = keccak256("SnowmanClaim(address receiver,uint256 amount)");
bytes32 canonicalDigest = keccak256(
abi.encodePacked(
"\x19\x01", domainSeparator, keccak256(abi.encode(canonicalTypehash, alice, uint256(1)))
)
);
​
assertTrue(canonicalDigest != airdrop.getMessageHash(alice), "compliant digest != contract digest");
​
(uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, canonicalDigest);
​
vm.prank(alice);
snow.approve(address(airdrop), type(uint256).max);
​
vm.prank(alice);
vm.expectRevert(SnowmanAirdrop.SA__InvalidSignature.selector);
airdrop.claimSnowman(alice, AL_PROOF, v, r, s);
}
}

Result:

[PASS] test_M02_CanonicalEip712SignatureIsRejected() (gas: 107927)
Suite result: ok. 1 passed; 0 failed; 0 skipped

Note on the project's own test

TestSnowmanAirdrop::testClaimSnowman passes only because it calls airdrop.getMessageHash(alice) and signs the contract's own (non-conformant) digest. It never validates against the EIP-712 standard, so the suite cannot detect this class of defect.

Recommended Mitigation

Correct the type string. Optionally also skip the signature requirement for self-claims, since msg.sender == receiver already proves authorisation.

- bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)");
+ bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(address receiver,uint256 amount)");
- if (!_isValidSignature(receiver, getMessageHash(receiver), v, r, s)) {
- revert SA__InvalidSignature();
+ if (msg.sender != receiver) {
+ if (!_isValidSignature(receiver, getMessageHash(receiver), v, r, s)) {
+ revert SA__InvalidSignature();
+ }
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 15 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-02] Unconsistent `MESSAGE_TYPEHASH` with standart EIP-712 declaration on contract `SnowmanAirdrop`

# Root + Impact ## Description * Little typo on `MESSAGE_TYPEHASH` Declaration on `SnowmanAirdrop` contract ```Solidity // src/SnowmanAirdrop.sol 49: bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)"); ``` **Impact**: * `function claimSnowman` never be `TRUE` condition ## Proof of Concept Applying this function at the end of /test/TestSnowmanAirdrop.t.sol to know what the correct and wrong digest output HASH. Ran with command: `forge test --match-test testFrontendSignatureVerification -vvvv` ```Solidity function testFrontendSignatureVerification() public { // Setup Alice for the test vm.startPrank(alice); snow.approve(address(airdrop), 1); vm.stopPrank(); // Simulate frontend using the correct format bytes32 FRONTEND_MESSAGE_TYPEHASH = keccak256("SnowmanClaim(address receiver, uint256 amount)"); // Domain separator used by frontend (per EIP-712) bytes32 DOMAIN_SEPARATOR = keccak256( abi.encode( keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"), keccak256("Snowman Airdrop"), keccak256("1"), block.chainid, address(airdrop) ) ); // Get Alice's token amount uint256 amount = snow.balanceOf(alice); // Frontend creates hash using the correct format bytes32 structHash = keccak256( abi.encode( FRONTEND_MESSAGE_TYPEHASH, alice, amount ) ); // Frontend creates the final digest (per EIP-712) bytes32 frontendDigest = keccak256( abi.encodePacked( "\x19\x01", DOMAIN_SEPARATOR, structHash ) ); // Alice signs the digest created by the frontend (uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, frontendDigest); // Digest created by the contract (with typo) bytes32 contractDigest = airdrop.getMessageHash(alice); // Display both digests for comparison console2.log("Frontend Digest (correct format):"); console2.logBytes32(frontendDigest); console2.log("Contract Digest (with typo):"); console2.logBytes32(contractDigest); // Compare the digests - they should differ due to the typo assertFalse( frontendDigest == contractDigest, "Digests should differ due to typo in MESSAGE_TYPEHASH" ); // Attempt to claim with the signature - should fail vm.prank(satoshi); vm.expectRevert(SnowmanAirdrop.SA__InvalidSignature.selector); airdrop.claimSnowman(alice, AL_PROOF, v, r, s); assertEq(nft.balanceOf(alice), 0); } ``` ## Recommended Mitigation on contract `SnowmanAirdrop` Line 49 applying this: ```diff - bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(addres receiver, uint256 amount)"); + bytes32 private constant MESSAGE_TYPEHASH = keccak256("SnowmanClaim(address receiver, uint256 amount)"); ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!