Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
AirDropper
Submissions
AI First Flight
AirDropper
AI First Flight #5
Beginner Friendly
DeFi
Foundry
EXP
AI First Flight
EXP
Oct 10th, 2026 → Oct 12th, 2026
View repo
View results
4 / 4
Submissions
Severity
Validity
Tags
Author
#1
MerkleAirdrop::claim records no claimed state, so a valid (account, amount, proof) can be replayed and one recipient, or any third party paying 1 gwei per call, drains the whole airdrop while the other recipients get nothing
High
Valid
[H-02] Eligible users can c...
friedsocks233
#2
Deploy.s.sol passes one USDC address to the MerkleAirdrop constructor but funds a different address, so every claim reverts and the 100 USDC sent to the airdrop is permanently locked
High
Valid
[H-01] Address of USDC toke...
friedsocks233
#3
Merkle root hard-coded in Deploy.s.sol commits 25e18 per recipient for 6-decimal USDC funded with 100e6, so no claim can pass both the proof check and the balance check and the airdrop can never pay out
High
Valid
[H-03] Wrong Merkle Root us...
friedsocks233
#4
No ERC20 recovery path in MerkleAirdrop (immutable root and token, no sweep, setter or deadline) turns tokens stranded by a misconfigured deployment, or sent by mistake, into a permanent loss
Low
Invalid
friedsocks233
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
