Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
MyCut
Submissions
AI First Flight
MyCut
AI First Flight #8
Beginner Friendly
Foundry
EXP
AI First Flight
EXP
Oct 10th, 2026 → Oct 12th, 2026
View repo
View results
8 / 8
Submissions
Severity
Validity
Tags
Author
#1
Pot::closePot divides the claimant bonus by i_players.length instead of claimants.length, so in-time claimants are underpaid and the non-claimers' share is stranded in the Pot
High
Valid
[H-02] Incorrect logic in `...
friedsocks233
#2
Pot::closePot pays the 10% manager cut to msg.sender, which is always the ContestManager contract (the Pot's owner); ContestManager has no function to move tokens out, so every manager fee is locked forever
High
Valid
[H-01] Owner Cut Stuck in `...
friedsocks233
#3
Pot::claimCut never checks the 90-day deadline or a closed state, so players who missed the window can still claim before or after closeContest, diluting the in-time claimants' bonus and the manager cut
Medium
Invalid
friedsocks233
#4
ContestManager::fundContest has no already-funded guard, so a repeated call pulls another full totalRewards into the Pot, where Pot's accounting ignores it and no function can ever return it to the owner
Low
Invalid
friedsocks233
#5
createContest and the Pot constructor never validate players, rewards and totalRewards (sum mismatch, duplicates, zero entries, empty list), so promised rewards become unclaimable, phantom remainders are paid out or the pot cannot close
Low
Invalid
friedsocks233
#6
Pot and ContestManager ignore the bool returned by ERC20 transfer/transferFrom; with an EIP-20 token that returns false, claimCut erases a player's entitlement without paying them and fundContest succeeds while funding nothing
Low
Invalid
friedsocks233
#7
Pot::closePot never updates remainingRewards and sets no closed flag, so a repeated closeContest pays the stale manager cut and claimant bonus again, starves post-close claimers and leaves the remaining-rewards views stale
Low
Invalid
friedsocks233
#8
Pot starts its 90-day claim clock at deployment (createContest), not at funding (fundContest), so when funding is delayed the pot can be closed after fewer than 90 claimable days, or in the funding block itself
Low
Invalid
friedsocks233
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
