`SnowmanAirdrop::claimSnowman` builds the Merkle leaf from the live `Snow` balance, so 1 unit of dust permanently blocks a claim
Root + Impact
Description
-
Eligibility is committed at snapshot time:
script/GenerateInput.s.solrecords each whitelisted user's balance, every leaf iskeccak256(receiver, amount), and the root is fixed asimmutableat deployment. -
However,
claimSnowmanrebuilds the leaf fromi_snow.balanceOf(receiver)at execution time instead of taking the committedamountas a parameter, so the proof verifies only while the live balance is exactly the snapshot value — andSnowis a freely transferable ERC-20 that anyone can push to anyone.
The claimer cannot pass the snapshot amount explicitly, so once the balance moves there is no way to prove the recorded allocation.
Risk
Likelihood:
-
Any address sends 1 unit of
Snowto a whitelisted claimer and the proof stops verifying. The cost is one unit, free viaearnSnow(), and ERC-20 gives the victim no way to reject the transfer. Moving the dust out and claiming can be defeated by front-running with another transfer. -
It also happens with no attacker, to users behaving exactly as intended: the token is designed to be earned weekly and bought throughout a 12-week window while the root is fixed at deployment, so a single
earnSnow()call after the snapshot locks a user out of their own allocation.
Impact:
-
A whitelisted user's allocation becomes permanently unclaimable.
i_merkleRootisimmutablewith no way to update or re-snapshot, so the protocol has no recovery path. -
The denial is cheap, repeatable, and targetable at any specific claimer by an attacker who keeps no position and risks nothing.
Proof of Concept
Alice keeps her tokens but can never claim her NFTs, and nothing on-chain can restore her eligibility except returning to exactly 1 unit.
Recommended Mitigation
Take the allocation as an explicit parameter, as standard Merkle airdrops do, and require only that the claimer still holds at least that much.
The leaf then depends only on values fixed at snapshot time, so later balance changes — whether accidental or hostile — cannot invalidate a proof. getMessageHash must take the same explicit amount so the signature commits to it, which also stops it reverting for users whose balance is currently zero.
Lead Judging Commences
[M-01] DoS to a user trying to claim a Snowman
# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.  ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.