Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
MyCut
Submissions
AI First Flight
MyCut
AI First Flight #8
Beginner Friendly
Foundry
EXP
AI First Flight
EXP
Sep 27th, 2026 → Sep 27th, 2026
View repo
View results
10 / 10
Submissions
Severity
Validity
Tags
Author
#1
Manager cut is transferred to the ContestManager contract instead of the admin, and since ContestManager has no token withdrawal function, 10% of the remaining pool is permanently frozen on every pot close
High
Valid
[H-01] Owner Cut Stuck in `...
sillyrobot796
#2
Unclaimed remainder is divided by the total player count i_players.length instead of the actual claimant count claimants.length, underpaying every timely claimant and permanently locking the rest inside the Pot
High
Valid
[H-02] Incorrect logic in `...
sillyrobot796
#3
When no player claims within the 90-day window, closePot distributes nothing to claimants and leaves 90% of the pot permanently frozen with no recovery path
Medium
Valid
[M-01] Incorrect Handling o...
sillyrobot796
#4
closePot is not idempotent — no closed flag exists and remainingRewards is never reset, so the owner can repeatedly close the same pot and drain it over multiple transactions at the expense of non-claiming players
High
Invalid
sillyrobot796
#5
claimCut has no 90-day deadline and no awareness of pot closure, so claims remain (nominally) possible after close — reverting with a confusing ERC20 error for late players, or fully succeeding when the pot is over-funded
Medium
Invalid
sillyrobot796
#6
fundContest has no funded-guard, so the owner can (and a retried transaction will) fund the same pot multiple times, permanently locking every excess deposit inside the Pot
Medium
Invalid
sillyrobot796
#7
createContest never validates sum(rewards) == totalRewards, so an over-budgeted rewards array makes claimCut hit an arithmetic underflow Panic(0x11) that permanently bricks every later player's claim
Medium
Invalid
sillyrobot796
#8
Duplicate addresses in the players array silently overwrite earlier rewards in the constructor, permanently locking the overwritten amounts and inflating the close-time distribution divisor
High
Valid
[H-03] [M1] `Pot::construct...
sillyrobot796
#9
createContest accepts an empty players array, and closePot then divides by i_players.length == 0, reverting with Panic(0x12) on every close so the fully-funded pot is permanently frozen
Low
Invalid
sillyrobot796
#10
closePot's floor divisions strand the non-divisible remainder, and with no sweep function the dust from every non-even pot is permanently locked
Low
Valid
[L-03] [H-03] Precision los...
sillyrobot796
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
