Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Santa's List
Submissions
AI First Flight
Santa's List
AI First Flight #3
Beginner Friendly
Foundry
EXP
AI First Flight
EXP
Sep 25th, 2026 → Sep 26th, 2026
View repo
View results
10 / 10
Submissions
Severity
Validity
Tags
Author
#1
Missing access control on `SantasList::checkList()` allows anyone to set an address's status
High
Valid
[H-01] Anyone is able to ca...
arush
#2
Default mapping value causes every unchecked address to be treated as `NICE`
High
Valid
[H-02] All addresses are co...
arush
#3
`SantasList::buyPresent()` burns the wrong party's tokens and mints the present to the wrong recipient
High
Valid
[H-03] SantasList::buyPrese...
arush
#4
Reentrancy in `SantasList::collectPresent()` enables unlimited free presents via `buyPresent()`
Medium
Invalid
arush
#5
Malicious code injected into the imported Solmate `ERC20::transferFrom()` lets a backdoored address drain `SantaToken`
High
Valid
[H-05] Malicious Code Injec...
arush
#6
Malicious `ffi` cheatcode usage in `SantasListTest.t.sol` allows arbitrary shell command execution
High
Valid
[H-06] Malicious Test poten...
arush
#7
`SantasList::buyPresent()` burns only half of the intended `PURCHASED_PRESENT_COST`
Medium
Valid
[M-01] Cost to buy NFT via ...
arush
#8
`SantasList::collectPresent()` has no closing date and remains callable indefinitely after Christmas 2023
Low
Valid
[L-01] collectPresent() can...
arush
#9
Solidity version `0.8.22` targets an EVM version incompatible with Arbitrum at time of deployment
Low
Invalid
arush
#10
`SantasList::buyPresent()` burns payment before confirming the present mint succeeds
Low
Invalid
arush
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
