OpenLeverage contest - cmichel's results

Handle

cmichel

Vulnerability details

The Airdrop.claim(s) functions allow claiming the airdrop tokens of other users. While the tokens are sent to the correct address, this can lead to issues with the accounting of EOAs or smart contracts that might rely on claiming the tokens themselves.

function claimAndDoSomething(uint256 _trancheId, uint256 _balance, bytes32[] calldata _merkleProof) {
    uint256 claimedAmount = token.balanceOf(address(this));
    airdrop.claim(address(this), _trancheId, _balance, _merkleProof);
    claimedAmount = token.balanceOf(address(this)) - claimedAmount;
    // do something with the tokens
    token.transfer(externalWallet, claimedAmount);
}

Impact

Claiming can incur a taxable event and the timing is better left to the actual owner. If a contract is deployed to claim a tranche and it has no other functions to transfer out funds, they may be locked forever in this contract.

Recommended Mitigation Steps

Do not allow users to claim on behalf of other users.