Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Puppy Raffle
Submissions
AI First Flight
Puppy Raffle
AI First Flight #1
Beginner Friendly
Foundry
Solidity
NFT
EXP
AI First Flight
EXP
Aug 13th, 2026 → Aug 13th, 2026
View repo
View results
8 / 8
Submissions
Severity
Validity
Tags
Author
#1
Reentrancy in refund — ETH is sent before the player slot is zeroed, so a malicious entrant re-enters and drains the entire contract balance
High
Valid
[H-02] Reentrancy Vulnerabi...
hopeh
#2
Weak on-chain randomness in selectWinner — winner and rarity are derived from msg.sender/block.timestamp/block.difficulty, so entrants can predict or manipulate the draw
High
Valid
[H-03] Randomness can be gamed
hopeh
#3
totalFees is uint64 accumulated without overflow checks (0.7.6) — once fees pass ~18.44 ETH the counter wraps, permanently bricking withdrawFees and stranding the fees
High
Valid
[H-05] Typecasting from uin...
hopeh
#4
enterRaffle's nested duplicate check is O(n²) over an unbounded array — gas grows quadratically, pricing out and eventually blocking entry (DoS)
Medium
Valid
[M-01] `PuppyRaffle: enterR...
hopeh
#5
withdrawFees requires balance == totalFees exactly — anyone can selfdestruct ETH in to break the equality and permanently lock all fees
Medium
Valid
[M-02] Slightly increasing ...
hopeh
#6
selectWinner reverts if the winner can't accept ETH or the ERC721 — a contract entrant without receive/onERC721Received freezes payout and the next raffle
Medium
Valid
[M-03] Impossible to win ra...
hopeh
#7
getActivePlayerIndex returns 0 for both a non-existent player and the index-0 player, so the first entrant is told they aren't in the raffle
Low
Valid
[L-01] Ambiguous index retu...
hopeh
#8
Unsafe downcast uint64(fee) truncates when a single round's fee exceeds type(uint64).max, silently losing fees
High
Valid
[H-05] Typecasting from uin...
hopeh
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
