FSA: A Framework for Analyzing Secondary Preimage Attacks on Merkle Proof-Based Airdrops

Abstract

Merkle proof-based airdrops are a widely used mechanism in decentralized finance (DeFi) for distributing tokens securely and efficiently to eligible recipients. By leveraging Merkle trees, these airdrops minimize storage requirements and reduce transaction costs while ensuring the integrity of recipient lists. Unfortunately, their importance also attracts sophisticated attacks. Secondary preimage attacks, in particular, pose a major risk to the security of token distribution, potentially enabling adversaries to exploit vulnerabilities and drain tokens from airdrop contracts. This paper introduces FSA: a F ramework for analyzing S econdary preimage A ttacks on Merkle proof-based airdrops, designed to systematically address such vulnerabilities. The framework operates through four core contributions: (1) a validated quantitative damage assessment model using proof-of-concept experiments, (2) an analysis of attack repetition patterns in binary Merkle trees and Merkle Mountain Ranges, (3) identification of key factors influencing attack success, including token balances, hash values, and variable sizes, and (4) evaluation of mitigation strategies such as using non-64-byte leaf values, asymmetric hashing, and proof length validation. Through extensive analysis using the FSA, our experimental results demonstrate the framework's effectiveness in uncovering vulnerability patterns and developing targeted countermeasures.