# Poor detection of disputed trees allows claiming tokens from a disputed tree

Distributor.getMerkleRoot ignores the disputer flag once the dispute period ends, so a disputed malicious Merkle tree stays claimable and can drain contract funds.

- Payout: Contest reward
- Severity: high
- Program: Angle Protocol
- Credited: Jeiwan
- Disclosed: 2023-08-09
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-06-angle-findings/issues/10
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-angle%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Distributor.sol Merkle reward distributor contract
**Root cause:** getMerkleRoot only checks block.timestamp >= endOfDisputePeriod and returns the current tree root, ignoring that disputer is set; a tree disputed near period end (or unresolved by governor) remains live for claims.
**Steps:**
1. Trusted EOA calls addMerkleRoot with a root letting it claim the entire contract balance
2. A disputer calls disputeTree, setting disputer address
3. Wait until block.timestamp >= endOfDisputePeriod while dispute unresolved
4. Call claim() with the malicious tree's proof; getMerkleRoot returns tree.merkleRoot because timestamp check passes
5. Claim succeeds, draining funds
**How found:** Code reading of getMerkleRoot's dispute-period logic; noticed it checks only timestamp, not the disputer address set by disputeTree, so a disputed-but-expired tree is treated as valid.
**Exploitation:** Malicious trusted EOA submits a self-serving Merkle root, times it so the dispute period expires before governor/guardian resolves the dispute (e.g. during inactivity), then claims the full contract balance via the still-live disputed root.
**Insight:** When a contract gates on a time window to defer to a previous state, check every other state flag (like disputer) that marks the new state as invalid; a timestamp-only guard leaves a window where disputed data is still trusted.