Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Weather Witness
Submissions
First Flights
Weather Witness
First Flight #40
Beginner Friendly
Foundry
Solidity
NFT
100
EXP
First Flights
100
EXP
May 15th, 2025 → May 22nd, 2025
View repo
253 / 253
Submissions
Severity
Tags
#1
-weather-witness
Medium
#2
-weather-witness
Medium
#3
Anyone can call the requestMintWeatherNFT and mint NFT.
High
#4
No withdrawal function causing funds to be stuck in the contract
High
#5
No validation of ownership when fulfilling mint requests causing NFTs being able to be stolen by anyone
High
#6
Keepers can update the NFT’s weather data before the allowed update time (heartbeat) has passed
Medium
#7
NFT Can Be Stolen by Front-Running the fulfillMintRequest() Function
High
#8
Broken Access Control in fulfillMintRequest Allows NFT Theft
High
#9
Missing Enum Validation Allows Invalid Weather States
Medium
#10
[H-1] Unchecked call of `WeatherNft::fulfillMintRequest` can lead to an unathorized call of a random user, leading to a potential steal of the NFT
High
#11
Business Logic Flaw: Missing LINK Deposit Validation Leads to Keeper Registration Break
Medium
#12
Front-running Mint Requests
Medium
#13
Reentrancy via Malicious ERC20 (LINK) Transfer
Low
#14
Missing Access Control in fulfillMintRequest
Medium
#15
Missing Access Control in fulfillMintRequest()
High
#16
Oracle Failure Can Permanently Burn Mint Fee Without Refund
Medium
#17
[M-2] Unconditional Price Bump in `requestMintWeatherNFT` Enables Front‑Running and User DOS
Medium
#18
Visibility Function is Broke, Every One CAN BREAK Gas Limit
High
#19
Loss of Funds and Unjust Price Inflation in `WeatherNft::requestMintWeatherNFT`
Medium
#20
NFT Theft via Front-Runnable Minting
High
#21
## WeatherNft.sol ## [ Using _mint can be dangerous ]
Medium
#22
##WeatherNft.sol## [ Emit before state change ]
Low
#23
User can fulfill one requests multiple times
High
#24
Malicious user can mint on behalf of the user who requested
High
#25
Lack of Validation for LINK Deposit Allows Silent Automation Failure in `WeatherNft::fulfillMintRequest`
Low
#26
User Loses Minting Fee if Keeper Registration Attempted with Zero LINK Deposit
Medium
#27
[M-1] Silent Return on Error in fulfillMintRequest Function Causes Loss of User Feedback
Medium
#28
Potential Front-Running in `WeatherNft::requestMintWeatherNFT`
Medium
#29
Unrestricted Access to `fulfillMintRequest()` Allows NFT Theft
High
#30
Using http for getting geo location
Medium
Previous
1
2
3
...
More pages
9
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
