Solidity Challenge #446 🕵️ The TimedDrop contract is designed for token airdrops. Each time the airdrop function is called, this timer resets to another 30 days and the signer is cleared and ready for the next drop. The function is intended to mint 1000 tokens (the AIRDROP_AMOUNT) to the caller if the signature is verified. Tell us if you can break the logic and claim airdrops whenever you want.
The above contract will be subject to reentrancy attack
remove the timer variable, now the function only checks for valid signatures
Timer and address update should be above mint func
Let's just claim the airdrop. Signer is null and let the signature be invalid, so it'll return zero address. Claim possible
Well, I can decide to authorise a malicious signer to claim more tokens
Great amount of work brings great utmost success
This is nice.
Exciting
Smart Contract Engineer & Security Researcher | DevRel Engineer | Blockchain Developer
3moonce the 30 days pass from the time of deployment, anyone can call the airdrop function to set himself as the new signer, then can call repeatedly the function and the require statement will always pass because of replay attack vulnerability.