Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
NFT Dealers
Submissions
First Flights
NFT Dealers
First Flight #58
Beginner Friendly
Foundry
100
EXP
First Flights
100
EXP
Mar 12th, 2026 → Mar 19th, 2026
View repo
399 / 399
Submissions
Severity
Tags
#1
Blackwidow
High
#2
Violation of Checks-Effects-Interactions
Low
#3
Collateral is reused across multiple resales, causing insolvency and stuck funds
High
#4
Seller can repeatedly collect proceeds from a settled listing and steal funds from later sales
High
#5
collectUsdcFromSelling` Can Be Called Repeatedly to Drain All Contract USDC
High
#6
`collectUsdcFromSelling` Transfers Fees to `address(this)` (Self-Transfer) -- Fees Are Never Separated, Leading to Protocol Insolvency
High
#7
Listing Price Stored as `uint32` Silently Truncates USDC Amounts Above ~4,294 USDC, Causing Massive Buyer Fund Loss
High
#8
collectUsdcFromSelling has no protection again multiple calls allowing malicius user to drain almost all usdc liquidity from the protocol selling one NFT
High
#9
Silent uint32 Price Truncation on function `list()` Allows Severe Underpricing of Listings
Medium
#10
Contract locks Ether without a withdraw function
Medium
#11
NFTDealers::collectUsdcFromSelling fails to reset collateralForMinting allowing sellers to drain contract funds
High
#12
NFTDealers::cancelListing incorrectly returns collateral allowing sellers to get free NFTs
High
#13
NFTDealers::buy does not follow CEI pattern allowing reentrancy to buy NFT multiple times
Medium
#14
NFTDealers::mintNft does not follow CEI pattern enabling reentrancy via onERC721Received callback
Medium
#15
Missing Zero Address Validation in Constructor Permanently Bricks Protocol
Low
#16
Floating pragma allows compilation with unintended compiler versions
Low
#17
NFTDealers::collectUsdcFromSelling transfers fees to itself wasting gas
Low
#18
mintNft() and buy() Are payable but Lack ETH Handling, Permanently Locking Sent ETH
Medium
#19
revealCollection() missing event
Low
#20
[H-01] Missing state update in collectUsdcFromSelling allows sellers to infinitely drain the contract's USDC balance
High
#21
[C-01] collateralForMinting Never Reset in buy() Allows Repeated Collateral Drain
High
#22
[H-02] cancelListing incorrectly refunds minting collateral without burning the NFT, enabling free mints
High
#23
[H-03] State storage collision: list() uses _tokenId as mapping key instead of listingsCounter, breaking core marketplace functionality
High
#24
[M-01] Unnecessary payable modifier on mintNft and buy functions traps native ETH permanently
Medium
#25
[M-02] Silent truncation in list and updatePrice due to uint32 casting causes massive loss of funds
Medium
#26
Cancel lisitng sending lock amount to whitelisted user (seller), allowing whitelisted user to mint entire MAX_SUPPLY with minimal capital
High
#27
Seller can steal other users' USDC by calling collectUsdcFromSelling() after cancelling a listing
High
#28
Inconsistent mapping key between listing stored (mint) and get function causes all listings to be permanently unreachable
High
#29
`NFTDealers::updatePrice()` missing `MIN_PRICE` check allows seller to bypass minimum price enforcement
High
#30
Repeated collectUsdcFromSelling calls allow sellers to drain the entire contract balance
High
Previous
1
2
3
...
More pages
14
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
