Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

claimSnowman() Uses Live Balance Instead of Merkle Snapshot, Causing Permanent Proof Invalidation

tsaqifalk

Root + Impact

Description

The claimSnowman() function in SnowmanAirdrop.sol distributes Snowman NFTs to eligible users via Merkle proof verification. The Merkle tree is generated offline with a snapshot of user addresses and their Snow token balances at a specific point in time.

The function computes the Merkle leaf from the receiver's current Snow balance at claim time using i_snow.balanceOf(receiver) (line 84), rather than using the balance value embedded in the Merkle tree. This creates a state dependency: any change to a user's Snow balance between tree generation and claiming, whether from earning, buying, receiving transfers, or front-running, causes the computed leaf to diverge from the tree, making the proof permanently invalid for that user.

@> SnowmanAirdrop.sol:84-90

uint256 amount = i_snow.balanceOf(receiver); // LIVE balance, not snapshot
​
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
​
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert SA__InvalidProof();
}

The same issue exists in getMessageHash() (line 115), which also reads the live balance for signature computation, coupling the signature validity to real-time state.

Risk

Likelihood:

  • Users naturally earn or buy Snow tokens after the Merkle tree is generated, any balance change between tree creation and claim attempt permanently invalidates their proof, with no recovery mechanism.

  • An attacker can deliberately front-run a user's claimSnowman() transaction by transferring Snow tokens to the target, changing their balance and invalidating their proof before the transaction is mined.

Impact:

  • Legitimate users who are included in the Merkle tree lose their ability to claim Snowman NFTs when their Snow balance changes, the only recourse is to wait for a new Merkle tree to be generated with updated balances.

  • An attacker can grief any claimant by sending them a minimal amount of Snow (1 wei is sufficient to change the balance), permanently blocking their claim for the current distribution round at near-zero cost.

Proof of Concept

// test/PoC_SnapshotVsLive.t.sol
​
// PoC A, Attacker front-runs Alice's claim
function test_PoC_SnapshotVsLive_FrontRun() public {
// Alice balance=1, matches tree
assertEq(snow.balanceOf(alice), 1);
​
bytes32[] memory alProof = m.getProof(leaves, 0);
​
// Attacker earns Snow for free, sends to Alice
vm.warp(block.timestamp + 1 weeks);
vm.prank(attacker);
snow.earnSnow();
vm.prank(attacker);
snow.transfer(alice, 1);
​
// Alice balance changed from 1 to 2, proof now invalid
assertEq(snow.balanceOf(alice), 2);
​
// Alice tries to claim, REVERTS
vm.prank(alice);
snow.approve(address(airdrop), type(uint256).max);
bytes32 alDigest = airdrop.getMessageHash(alice);
(uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest);
​
vm.prank(satoshi);
vm.expectRevert(SnowmanAirdrop.SA__InvalidProof.selector);
airdrop.claimSnowman(alice, alProof, alV, alR, alS);
}
​
// PoC B, User accidentally changes own balance
function test_PoC_SnapshotVsLive_SelfInflicted() public {
assertEq(snow.balanceOf(alice), 1);
​
// Alice earns more Snow after tree generation
vm.prank(alice);
snow.earnSnow();
// Balance changed from 1 to 2, proof invalid
assertEq(snow.balanceOf(alice), 2);
​
bytes32[] memory alProof = m.getProof(leaves, 0);
vm.prank(alice);
snow.approve(address(airdrop), type(uint256).max);
bytes32 alDigest = airdrop.getMessageHash(alice);
(uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest);
​
vm.prank(satoshi);
vm.expectRevert(SnowmanAirdrop.SA__InvalidProof.selector);
airdrop.claimSnowman(alice, alProof, alV, alR, alS);
}
​
// Test results: PASS, both scenarios cause permanent proof invalidation

Recommended Mitigation

Record each user's Snow balance in the Merkle tree at generation time and use that recorded value instead of the live balance:

+ mapping(address => uint256) private s_claimAmount;
​
+ function setClaimAmount(address receiver, uint256 amount) external onlyOwner {
+ s_claimAmount[receiver] = amount;
+ }
​
function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
external
nonReentrant
{
- uint256 amount = i_snow.balanceOf(receiver);
+ uint256 amount = s_claimAmount[receiver];
+ require(amount > 0, "Not eligible");

Alternatively, record the balance snapshot in the Merkle leaf using a separate data structure (e.g., a mapping set at tree generation time) rather than reading from the live ERC20 balance.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] DoS to a user trying to claim a Snowman

# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.  ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!