Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Merkle leaf is built from the receiver's live Snow balance, so any balance change before claiming breaks the airdrop

coolteddy141

Root + Impact

Description

// src/SnowmanAirdrop.sol - the leaf amount is the receiver's live balance
@> function getMessageHash(address receiver) public view returns (bytes32) {
@> uint256 amount = i_snow.balanceOf(receiver);
@> if (amount == 0) {
@> revert SA__ZeroAmount();
@> }
@> return _hashTypedDataV4(keccak256(abi.encode(MESSAGE_TYPEHASH, receiver, amount)));
@> }
@> function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external {
@> bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
​
The Merkle tree is built once, from a snapshot: in test/TestSnowmanAirdrop.t.sol every leaf is (user, 1) because each user holds exactly 1 Snow at setup. Nothing freezes the balance afterwards. A user can earn or buy more Snow, or transfer some away, before claiming. If they do, the claim fails, because the two amounts are tied together in opposite directions: getMessageHash() signs the live balance, so the caller must pass amount equal to the live balance for the signature to verify, but the leaf is then (receiver, live balance), which is only in the tree if the live balance happens to equal the snapshot amount. The call reverts with SA__InvalidMerkleProof.
​
Impact: entitled users are locked out of the airdrop by ordinary, expected behaviour (buying more Snow before claiming). The only recovery is to move Snow in or out until the balance matches the snapshot amount exactly, which is undocumented, costs extra transactions, and may be impossible if the Snow was spent. The failure message also misleads users into thinking they were never eligible.

Risk

Likelihood:

Impact:

Proof of Concept

// Explanation: the signed amount and the Merkle leaf amount must both equal the receiver's Snow balance at claim time, while the tree was built from the balance at snapshot time. Any change in between breaks the claim, as the steps below show.
// 1. Alice is a leaf (aliceSB, 1 Snow) and holds 1 Snow at snapshot time.
// 2. Before claiming, Alice buys 1 more Snow (buySnow(1) with 5 ether).
// Her balance is now 2.
// 3. Alice signs getMessageHash(aliceSB). The digest covers amount 2.
// 4. Alice calls claimSnowman(aliceSB, 2, proof, v, r, s).
// The signature verifies, but the leaf is (aliceSB, 2), which is not
// in the Merkle tree - the leaf in the tree is (aliceSB, 1).
// The call reverts with SA__InvalidMerkleProof.
// 5. Alice can only claim by transferring 1 Snow away first, so her
// balance is 1 again, then signing and claiming with amount 1.
// The project's tests never change a balance between setup and claim
// (test/TestSnowmanAirdrop.t.sol), so this is untested.

Recommended Mitigation

Explanation: fix the entitled amount at snapshot time instead of reading the live balance, so later balance changes cannot break the claim.
- uint256 amount = i_snow.balanceOf(receiver);
+ uint256 amount = s_entitledAmount[receiver]; // fixed at deployment, from the Merkle snapshot
​
Add a mapping s_entitledAmount, set from the same data used to build the Merkle tree, and have claimSnowman() transfer and mint only that fixed amount, leaving any extra Snow in the user's wallet.
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] DoS to a user trying to claim a Snowman

# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.  ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!