User attempts to claim their full allocation

Oct 13, 2025 by talynt.org 102 views

Wobbly Denim Mink - Inconsistent Penalty Handling After Tax Payment

Introduction

The Wobbly Denim Mink project has been plagued by several issues, but one of the most significant concerns is the inconsistent penalty handling after tax payment. This problem arises from the AirdropDistribution contract, which intentionally adds an extra month of penalties for users who paid tax, contradicting the documented behavior. In this article, we will delve into the root cause of this issue, explore the pre-conditions and attack path, and discuss the impact on tax-paying users.

Root Cause

The incorrect penalty calculation in AirdropDistribution will cause financial loss for tax-paying users as the contract will unfairly penalize them by applying an extra month of penalties, contradicting the documented behavior. The code in the AirdropDistribution contract is responsible for this issue:

// In AirdropDistribution._available()
penaltyAmount = _computePenalty(
    $, totalAmount, account, hasPaidTax ? monthsPassed + 1 : monthsPassed
);

This adds an additional month of penalties specifically for users who paid tax, despite the README explicitly stating: "Once the tax is paid, they can claim the total amount directly without waiting for monthly releases." This inconsistency in the code directly contradicts the documentation, leading to unfair penalties for tax-paying users.

Internal Pre-conditions

For the penalty handling issue to occur, the following internal pre-conditions must be met:

User must be in the top 80% category: The user must be in the top 80% category, subject to the vesting schedule.
User must have paid tax: The user must have paid tax to skip vesting through the AirdropTaxCollector contract.
User's account must have penalties set by an admin: The user's account must have penalties set by an admin with the AIRDROP_PENALTY_OPERATOR_ROLE.

External Pre-conditions

There are no significant external pre-conditions that need to be met for the penalty handling issue to occur.

Attack Path

The attack path for this issue is as follows:

User pays tax: A user from the top 80% group decides to pay tax to skip vesting based on the documented promise that this allows claiming "the total amount directly without waiting."
User calls payTaxAmount(): User calls payTaxAmount() in the AirdropTaxCollector contract and pays the required tax.
User attempts to claim their full allocation: User attempts to claim their full allocation by calling claim() in the AirdropDistribution contract.
Contract applies penalties: The function calls _available() which invokes _computePenalty() with monthsPassed + 1 because hasPaidTax is true.
User receives less than expected airdrop amount: The contract applies penalties for an additional month beyond what the user has already experienced, resulting in the user receiving less than their expected airdrop amount.

Impact

Tax-paying users suffer an unfair reduction in their airdrop allocation. Depending on the penalty percentages, this could result in a significant loss (potentially up to 100% of a month's allocation). This directly contradicts the documented behavior that tax payment allows claiming "the total amount directly without waiting for monthly releases."

PoC

There is no response from the project team regarding this issue.

Mitigation

To mitigate this issue, the penalty calculation should be modified to correctly implement the documented behavior by removing the extra month penalty for users who paid tax:

// Corrected version
penaltyAmount = _computePenalty(
    $, totalAmount, account, monthsPassed
);

Alternatively, the code can be modified to explicitly handle the case where the user has paid tax:

// Alternative corrected version with clear intention
penaltyAmount = hasPaidTax 
    ? _computePenalty($, totalAmount, account, monthsPassed) 
    : _computePenalty($, totalAmount, account, monthsPassed);

By implementing these changes, the Wobbly Denim Mink project can ensure that tax-paying users are not unfairly penalized and that the documented behavior is correctly implemented.
Wobbly Denim Mink - Inconsistent Penalty Handling After Tax Payment: Q&A

Introduction

In our previous article, we discussed the inconsistent penalty handling after tax payment in the Wobbly Denim Mink project. This issue arises from the AirdropDistribution contract, which intentionally adds an extra month of penalties for users who paid tax, contradicting the documented behavior. In this Q&A article, we will address some of the most frequently asked questions about this issue.

Q: What is the root cause of the inconsistent penalty handling?

A: The root cause of the inconsistent penalty handling is the code in the AirdropDistribution contract, which adds an extra month of penalties for users who paid tax, despite the README explicitly stating that tax payment allows claiming the total amount directly without waiting for monthly releases.

Q: What are the internal pre-conditions for the penalty handling issue to occur?

A: The internal pre-conditions for the penalty handling issue to occur are:

The user must be in the top 80% category, subject to the vesting schedule.
The user must have paid tax to skip vesting through the AirdropTaxCollector contract.
The user's account must have penalties set by an admin with the AIRDROP_PENALTY_OPERATOR_ROLE.

Q: What is the attack path for this issue?

A: The attack path for this issue is as follows:

A user from the top 80% group decides to pay tax to skip vesting based on the documented promise that this allows claiming "the total amount directly without waiting."
The user calls payTaxAmount() in the AirdropTaxCollector contract and pays the required tax.
The user attempts to claim their full allocation by calling claim() in the AirdropDistribution contract.
The function calls _available() which invokes _computePenalty() with monthsPassed + 1 because hasPaidTax is true.
The contract applies penalties for an additional month beyond what the user has already experienced, resulting in the user receiving less than their expected airdrop amount.

Q: What is the impact of this issue on tax-paying users?

A: Tax-paying users suffer an unfair reduction in their airdrop allocation. Depending on the penalty percentages, this could result in a significant loss (potentially up to 100% of a month's allocation). This directly contradicts the documented behavior that tax payment allows claiming "the total amount directly without waiting for monthly releases."

Q: Is there a proof of concept (PoC) for this issue?

A: There is no response from the project team regarding this issue.

Q: How can the issue be mitigated?

A: To mitigate this issue, the penalty calculation should be modified to correctly implement the documented behavior by removing the extra month penalty for users who paid tax:

// Corrected version
penaltyAmount = _computePenalty(
    $, totalAmount, account, monthsPassed
);

Alternatively, the code can be modified to explicitly handle the case where the user has paid tax:

// Alternative corrected version with clear intention
penaltyAmount = hasPaidTax 
    ? _computePenalty($, totalAmount, account, monthsPassed) 
    : _computePenalty($, totalAmount, account, monthsPassed);

Q: What is the next step for the project team?

A: The project team should address this issue by implementing the necessary changes to the AirdropDistribution contract to ensure that tax-paying users are not unfairly penalized and that the documented behavior is correctly implemented.

Q: How can users protect themselves from this issue?

A: Users can protect themselves from this issue by carefully reviewing the documentation and ensuring that they understand the penalty structure before paying tax. Additionally, users can consider waiting for the project team to address this issue before paying tax.

Q: What is the timeline for the project team to address this issue?

A: The project team has not provided a specific timeline for addressing this issue. However, users can expect the project team to prioritize this issue and provide a solution as soon as possible.

Q: How can users provide feedback to the project team?

A: Users can provide feedback to the project team by submitting a bug report or a feature request on the project's GitHub page. Users can also engage with the project team on social media platforms to express their concerns and provide feedback.