TokenTable Merkle Token Distributor
A co-audit by Zealynx Security and CODESPECT of the TokenTable Merkle Token Distributor, an EVM contract suite that manages airdrop and vesting distributions through Merkle proof verification. The 4-day review identified 4 issues across 620 SLOC: 1 Medium (locked NFTs in the ERC-721 distributor), 1 Low (upgrade permission scoped to the project owner), and 2 Informational. Two findings fixed, two acknowledged.
Scope
8 files · 620 SLOCFindings
click any row for the full write-upKey Findings
- Incorrect withdrawal implementation may lock unclaimed NFTs. In
SimpleERC721MerkleDistributor, thewithdraw()function attempts to transfer existing NFTs from the contract, but unclaimed NFTs are minted on demand rather than held by the contract. If minting permissions are scoped to the distributor and not the owner, the project team cannot recover unclaimed NFTs and they may be effectively lost. - Upgrade permission assigned to the project owner instead of TokenTable. The
_authorizeUpgradefunction inBaseMerkleDistributoris gated by the contract owner (the project team), not by TokenTable. A malicious project owner could upgrade the contract to a custom implementation that bypasses fee collection or redirects fees away from TokenTable. - NFT fee handling incompatible with BIPS-style fees.
claimedAmountfor ERC-721 distributions represents a small token count (e.g. 1 or 2). When theITTUFeeCollector::getFee()formula multiplies byfeeBips / BIPS_PRECISION, low values can round to zero, breaking BIPS-based fee policies for NFT distributions. getClaimDelegatenot blocked when delegated claiming is disabled.NFTGatedMerkleDistributordisables delegated claiming by reverting onsetClaimDelegate,batchDelegateClaim, anddelegateClaim, butgetClaimDelegateremains callable. The inconsistency is purely surface-level but should be aligned for clarity.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
