Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Santa's List
Submissions
AI First Flight
Santa's List
AI First Flight #3
Beginner Friendly
Foundry
EXP
AI First Flight
EXP
Aug 28th, 2026 → Aug 31st, 2026
View repo
View results
7 / 7
Submissions
Severity
Validity
Tags
Author
#1
NICE is enum member 0, so every unwritten mapping slot is already a passing verdict — any address mints a present with no grading
High
Valid
[H-02] All addresses are co...
itsactuallyomar
#2
## [H-2] `collectPresent` gates on a transferable ERC-721 balance instead of a collection record — one grading yields unlimited presents and unlimited SANTA
High
Valid
[H-04] Any `NICE` or `EXTRA...
itsactuallyomar
#3
## [H-3] `buyPresent` burns the parameter's tokens and mints the present to the caller — anyone destroys any holder's balance with no allowance
High
Valid
[H-03] SantasList::buyPrese...
itsactuallyomar
#4
## [H-4] `checkList` has no access control — anyone permanently revokes any graded user's eligibility and bricks `checkTwice`
High
Valid
[H-01] Anyone is able to ca...
itsactuallyomar
#5
## [HM-1] `SantaToken` inherits a forked ERC-20 whose `transferFrom` skips the allowance check for one hard-coded address — total supply seizure
High
Valid
[H-05] Malicious Code Injec...
itsactuallyomar
#6
## [HM-2] `TokenUri`'s 51 KB constant is inlined into `SantasList`, putting runtime code 2.48× over EIP-170 — the contract cannot be deployed
Low
Valid
[L-05] Oversized contract w...
itsactuallyomar
#7
## [M-1] `SantaToken.burn` hard-codes `1e18` while `PURCHASED_PRESENT_COST` publishes `2e18` — presents sell at half the stated price
Medium
Valid
[M-01] Cost to buy NFT via ...
itsactuallyomar
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
