Merkle airdrop/whitelist verification is flawed: missing per-leaf claim tracking, second-preimage weakness from packed leaves, or accepting proofs for the wrong root, allowing double or unauthorized claims.
mapping(address=>bool) public claimed;
function claim(uint256 amt, bytes32[] calldata p) external {
require(!claimed[msg.sender], "claimed");
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(msg.sender, amt))));
require(MerkleProof.verify(p, root, leaf), "bad proof");
claimed[msg.sender] = true; _mint(msg.sender, amt);
}
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0049 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.