Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Puppy Raffle
Submissions
AI First Flight
Puppy Raffle
AI First Flight #1
Beginner Friendly
Foundry
Solidity
NFT
EXP
AI First Flight
EXP
Oct 10th, 2026 → Oct 12th, 2026
View repo
View results
10 / 10
Submissions
Severity
Validity
Tags
Author
#1
Reentrancy in PuppyRaffle::refund(): sendValue() pays before the player slot is cleared, so one ticket can be refunded repeatedly to drain other players' deposits and accrued protocol fees
High
Valid
[H-02] Reentrancy Vulnerabi...
friedsocks233
#2
Weak RNG in selectWinner uses only caller-controlled or block-known inputs, so any player can settle the raffle only in a block where it wins and take 80% of the pool each round; NFT rarity is set by the caller address
High
Valid
[H-03] Randomness can be gamed
friedsocks233
#3
Refunded address(0) slots still count in selectWinner's players.length, so prizes are paid from accrued fees, unbacked fees are added to totalFees, and withdrawFees reverts
High
Valid
[H-04] `PuppyRaffle::refund...
friedsocks233
#4
Refunded address(0) slots count as duplicates in enterRaffle, so two refunds in one round make every later entry revert and can permanently brick the raffle at gas-only cost
High
Invalid
friedsocks233
#5
uint64 totalFees with unchecked 0.7.6 arithmetic truncates or wraps fees above ~18.45 ETH, so withdrawFees reverts forever and all accrued and future protocol fees are locked
High
Valid
[H-05] Typecasting from uin...
friedsocks233
#6
Strict equality `address(this).balance == totalFees` in withdrawFees lets 1 wei of forced ETH permanently freeze all accrued and future protocol fees
Medium
Valid
[M-02] Slightly increasing ...
friedsocks233
#7
enterRaffle checks every pair in the whole players array on each call, so entry gas grows quadratically and, at 265 players under a 30M gas limit, no one can enter for the rest of the round
Medium
Valid
[M-01] `PuppyRaffle: enterR...
friedsocks233
#8
PuppyRaffle::tokenURI inserts the rarity name without JSON quotes, so every minted puppy's metadata is invalid JSON and its name, image and rarity cannot be parsed
Low
Invalid
friedsocks233
#9
feeAddress is never checked for address(0), and withdrawFees can be called by anyone, so after an owner input error any account can permanently burn all accrued protocol fees
Low
Invalid
friedsocks233
#10
selectWinner pushes the prize with a required call and then calls _safeMint, so a drawn entrant that cannot accept ETH or an ERC721 reverts the whole draw: such entrants pay full price but can never win, and settlement is delayed
Low
Invalid
friedsocks233
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
