Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Santa's List
Submissions
AI First Flight
Santa's List
AI First Flight #3
Beginner Friendly
Foundry
EXP
AI First Flight
EXP
Aug 13th, 2026 → Aug 13th, 2026
View repo
View results
4 / 4
Submissions
Severity
Validity
Tags
Author
#1
checkList has no access control — anyone (not just Santa) can rewrite any address's checked-once status
High
Valid
[H-01] Anyone is able to ca...
hopeh
#2
Status.NICE is enum index 0, so every unchecked address defaults to NICE on both lists — anyone can collectPresent and mint a free NFT
High
Valid
[H-02] All addresses are co...
hopeh
#3
buyPresent is wired to the wrong parties — it burns the receiver's SantaTokens and mints the NFT to the caller, so anyone can destroy any holder's tokens and mint themselves a free NFT
High
Valid
[H-03] SantasList::buyPrese...
hopeh
#4
A present costs 1e18, not the documented PURCHASED_PRESENT_COST (2e18) — the cost constant is never used and SantaToken.burn hardcodes 1e18
Medium
Valid
[M-01] Cost to buy NFT via ...
hopeh
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
