Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Merkle leaf uses live Snow balance, allowing griefing and lockouts

ranktang

Root + Impact

Description

  • claimSnowman() does not use a fixed allocation amount from the Merkle tree. Instead, it reads the receiver’s current Snow balance and uses that as the amount for both the EIP-712 digest and the Merkle leaf.

    This means any change to the receiver’s Snow balance after the Merkle root is created will break their claim.

    An attacker can grief any eligible receiver by sending them even 1 wei of Snow. This changes their balance, causing the signature and/or Merkle proof to fail. The receiver can no longer claim their Snowman NFT unless they manage to restore the exact original balance.

// In claimSnowman():
​
@> uint256 amount = i_snow.balanceOf(receiver);
​
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
​
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert SA__InvalidProof();
}
​
//And in getMessageHash():
uint256 amount = i_snow.balanceOf(receiver);
​
return _hashTypedDataV4(
keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount})))
);

The Merkle tree is built off-chain with fixed allocations, but the contract verifies against the live balance. These two values are only equal if the receiver’s balance has not changed since the Merkle root was generated.

Any of the following breaks the claim:

  • The receiver buys Snow via buySnow()

  • The receiver earns Snow via earnSnow()

  • Someone transfers Snow to the receiver

  • The receiver transfers Snow out

The first two are normal protocol interactions. The third is a trivial griefing vector.

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Reason 2

Impact:

  • Any eligible claimer can be prevented from claiming their NFT by sending them Snow.

  • A claimer who buys or earns Snow before claiming locks themselves out of the airdrop.

  • The attacker does not need to spend much: 1 wei of Snow is enough to change the balance and invalidate the proof/signature.

  • If the receiver has already signed a message, the signature becomes invalid immediately after any balance change.

This is a denial-of-service issue against the airdrop mechanism.

Proof of Concept

Assume Alice is in the Merkle tree with allocation 1.

  1. Alice acquires exactly 1 Snow.

  2. Alice signs the digest for (alice, 1).

  3. Before Alice claims, an attacker sends 1 wei of Snow to Alice.

  4. Alice now has 1 + 1 wei Snow.

  5. Alice calls claimSnowman().

If Alice uses her old signature:

  • getMessageHash(alice) now returns a digest based on 1 + 1 wei.

  • The old signature no longer matches.

  • The transaction reverts with SA__InvalidSignature.

If Alice signs a new digest for 1 + 1 wei:

  • The Merkle leaf becomes keccak256(abi.encode(alice, 1 + 1 wei)).

  • The original Merkle proof for (alice, 1) no longer verifies.

  • The transaction reverts with SA__InvalidProof.

Either way, Alice cannot claim.

function testGriefClaimBySendingExtraSnow() public {
// Alice has exactly 1 Snow and a valid proof/signature for amount 1
deal(address(snow), alice, 1);
​
// Attacker sends 1 wei of Snow to Alice
deal(address(snow), alice, 1 + 1);
​
// Alice's original signature is now invalid
vm.prank(satoshi);
vm.expectRevert(SnowmanAirdrop.SA__InvalidSignature.selector);
airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS);
}

Recommended Mitigation

Do not derive the Merkle leaf amount from the live balance. Pass the expected allocation amount explicitly and verify it against the Merkle root.

Suggested changes:

  1. Add uint256 amount as a parameter to claimSnowman().

  2. Verify the Merkle leaf using that fixed amount.

  3. Check that the receiver has at least amount Snow, not exactly amount.

  4. Transfer exactly amount from the receiver to the airdrop contract.

  5. Update getMessageHash() to accept amount as a parameter.

function claimSnowman(
address receiver,
uint256 amount,
bytes32[] calldata merkleProof,
uint8 v,
bytes32 r,
bytes32 s
) external nonReentrant {
if (receiver == address(0)) revert SA__ZeroAddress();
if (amount == 0) revert SA__ZeroAmount();
if (s_hasClaimedSnowman[receiver]) revert SA__AlreadyClaimed();
​
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert SA__InvalidProof();
}
​
if (!_isValidSignature(receiver, getMessageHash(receiver, amount), v, r, s)) {
revert SA__InvalidSignature();
}
​
if (i_snow.balanceOf(receiver) < amount) {
revert SA__ZeroAmount(); // or a dedicated insufficient-balance error
}
​
i_snow.safeTransferFrom(receiver, address(this), amount);
​
s_hasClaimedSnowman[receiver] = true;
​
emit SnowmanClaimedSuccessfully(receiver, amount);
​
i_snowman.mintSnowman(receiver, amount);
}
​
function getMessageHash(address receiver, uint256 amount) public view returns (bytes32) {
return _hashTypedDataV4(
keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount})))
);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] DoS to a user trying to claim a Snowman

# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.&#x20; ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!