Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Vanguard
Submissions
First Flights
Vanguard
First Flight #56
Beginner Friendly
DeFi
Foundry
0
EXP
First Flights
0
EXP
Jan 29th, 2026 → Feb 5th, 2026
View repo
184 / 184
Submissions
Severity
Tags
#1
Per-Address Swap Tracking Tracks Router
High
#2
_resetPerAddressTracking() Only Resets address(0) Mappings
High
#3
Deploy Script Uses Wrong Hook Flag (BEFORE_INITIALIZE Instead of AFTER_INITIALIZE)
High
#4
Phase Duration Off-by-One Inconsistency Between _beforeSwap and getCurrentPhase
High
#5
Anti-Bot Protection Does Not Distinguish Buy vs Sell Directions
Medium
#6
initialLiquidity Uses Pool Total Liquidity Instead of Token-Specific Amount
Medium
#7
Global State Variables Prevent Safe Multi-Pool Usage
Medium
#8
Unused State Variables Waste Gas and Imply Non-Existent Functionality
Medium
#9
Missing Zero Cooldown Validation in Constructor
Low
#10
Missing Zero Limit Validation in Constructor
Low
#11
Fee Calculation Edge Case at Maximum Penalty Value
Low
#12
lastPhaseUpdateBlock State Variable Never Read
Low
#13
Broken tracking reset mechanism
Medium
#14
Unused state variable.
Low
#15
The key vulnerability is the owner's unrestricted access, which could be mitigated with multi-sig or timelock. Also, the reliance on "block numbers for phase timing" is a risk that may be manipulated.
Medium
#16
Deploy script initialize with wrong flag
High
#17
Router-based enforcement breaks per-user anti-bot limits and cooldowns
Medium
#18
Buy swaps are incorrectly subject to sell limits and penalty fees
Medium
#19
All users share single limit due to the tracking of router address
High
#20
Zero fee applied to legitimate users breaks LP revenue model
High
#21
_resetPerAddressTracking() Only Resets address(0), Breaking Phase Transition User Limit Reset
High
#22
_resetPerAddressTracking() Only Resets address(0), Breaking Phase Transition User Limit Reset
High
#23
Phase Boundary Inconsistency: _beforeSwap Uses <= While getCurrentPhase Uses <, Causing View Functions to Report Wrong Phase
Medium
#24
Anti-Bot Protection Bypassed: Hook Tracks Router Address Instead of User Address
High
#25
Dead Code: addressTotalSwaps and addressPenaltyCount Declared but Never Written
Low
#26
totalPenaltyFeesCollected Declared but Never Updated - Broken Accounting
Low
#27
Hardcoded ZERO_DELTA BeforeSwapDelta Allows Complete Bypass of Token Launch Anti-Botting Protections
High
#28
Stale initialLiquidity Storage as a result of liquidity removal can lead to Complete Protection Bypass
High
#29
_resetPerAddressTracking() Only Resets address(0) - User Tracking Persists Across Phase Transitions
High
#30
getCurrentPhase() Uses Different Comparison Operator Than _beforeSwap() Causing View/Swap Phase Mismatch
Medium
Previous
1
2
3
...
More pages
7
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
