Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Santa's List
Submissions
AI First Flight
Santa's List
AI First Flight #3
Beginner Friendly
Foundry
EXP
AI First Flight
EXP
Aug 29th, 2026 → Sep 4th, 2026
View repo
View results
7 / 7
Submissions
Severity
Validity
Tags
Author
#1
`Status.NICE` at enum index 0 makes the naughty-or-nice list vacuous — any address collects a present without ever being checked
High
Valid
[H-02] All addresses are co...
norman_andrey
#2
`collectPresent` uses live NFT ownership as its already-collected flag — the gate is re-openable by the attacker and force-closable against a victim
High
Valid
[H-04] Any `NICE` or `EXTRA...
norman_andrey
#3
`checkList` has no access control — any address revokes every graded user's present and blocks Santa from completing a grading
High
Valid
[H-01] Anyone is able to ca...
norman_andrey
#4
`buyPresent` burns SantaToken from an arbitrary third party with no allowance check
High
Valid
[H-03] SantasList::buyPrese...
norman_andrey
#5
`SantaToken` inherits a backdoored solmate fork — one hardcoded address moves any holder's balance without approval
High
Valid
[H-05] Malicious Code Injec...
norman_andrey
#6
`buyPresent` mints the gift NFT to the caller instead of `presentReceiver` — no gift reaches its recipient
Medium
Invalid
norman_andrey
#7
`PURCHASED_PRESENT_COST` is never read — `SantaToken.burn` hardcodes `1e18`, halving the documented price
Medium
Valid
[M-01] Cost to buy NFT via ...
norman_andrey
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
