Calyptus’ Post

View organization page for Calyptus, graphic

104,870 followers

Solidity Challenge #446 🕵️ The TimedDrop contract is designed for token airdrops. Each time the airdrop function is called, this timer resets to another 30 days and the signer is cleared and ready for the next drop. The function is intended to mint 1000 tokens (the AIRDROP_AMOUNT) to the caller if the signature is verified. Tell us if you can break the logic and claim airdrops whenever you want.

  • No alternative text description for this image
Sasha Flores

Smart Contract Engineer & Security Researcher | DevRel Engineer | Blockchain Developer

3mo

once the 30 days pass from the time of deployment, anyone can call the airdrop function to set himself as the new signer, then can call repeatedly the function and the require statement will always pass because of replay attack vulnerability.

The above contract will be subject to reentrancy attack

remove the timer variable, now the function only checks for valid signatures

Justina Okon

Student at University of Uyo

3mo

Timer and address update should be above mint func

Dheeraj Kumar Yaduwanshi 🇮🇳

Blockchain Developer(Immediate Joiner)| Smart Contract Security Researcher | EVM | DeFi | MScFE @WorldQuantUniversity

3mo

Let's just claim the airdrop. Signer is null and let the signature be invalid, so it'll return zero address. Claim possible

Like
Reply
Adeniji Aliyu

Software Engineer | Technical Writer | Blockchain Developer | Rust | Smart Contact Auditor | Solana Auditor | Security Researcher

3mo

Well, I can decide to authorise a malicious signer to claim more tokens

Christian Olasanchez

Blockchain Enthusiast, Community Manager, Research & Data Analyst, Affiliate/Growth Marketer | Discord: Sanchez_crypt | Twitter: sanchez_crypt

3mo

Great amount of work brings great utmost success

Like
Reply
Aditya Singh

Coding Enthusiast | learning ML, AI & Data Science | CSE '27

3mo

Exciting

Like
Reply
See more comments

To view or add a comment, sign in

Explore topics