claimSnowman derives the claim amount from the mutable live balance letting anyone permanently grief a recipient's claim
claimSnowman derives the claim amount from the mutable live balance letting anyone permanently grief a recipient's claim
Description
The airdrop allocation is fixed at snapshot time inside the immutable Merkle tree as (receiver, amount) pairs. A recipient's claim should be validated and sized against that committed amount. claimSnowman instead reads amount from the recipient's live Snow balance and builds the Merkle leaf from it, so the proof only verifies while the recipient's current balance exactly equals the snapshot amount. Because ERC20 tokens can be sent to any address without consent, anyone can push the recipient's balance off the committed value and permanently break their claim.
Risk
Likelihood:
Every recipient whose balance differs from their snapshot amount at claim time is blocked, and any third party can force that difference by transferring the recipient any nonzero amount of Snow (permissionless ERC20 transfer). The recipient also breaks their own claim by using the intended earnSnow/buySnow functions, since both change the live balance.
Impact:
Eligible recipients are permanently denied the Snowman NFTs they are entitled to, for an attacker cost of a single Snow token. Recovery is not reliable: the attacker re-grief the recipient whenever they restore the exact snapshot balance.
Proof of Concept
The PoC sets Alice as eligible for COMMITTED = 10 via a single-leaf tree. The control test confirms she claims 10 NFTs when her balance equals the snapshot. The exploit test then has an attacker transfer her 1 Snow (balance becomes 11), after which her legitimate claim reverts with SA__InvalidProof and she receives 0 NFTs. deal + a real transfer show this is an ordinary permissionless ERC20 send, not a test-only trick.
Recommended Mitigation
Stop deriving the amount from the live balance. Pass the committed amount as a parameter, bind it into both the signed message and the Merkle leaf, and mint/stake that committed value. The claim then depends only on the immutable tree, so a recipient's current balance (as long as it covers the stake) cannot invalidate their proof:
Lead Judging Commences
[M-01] DoS to a user trying to claim a Snowman
# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.  ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.