Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Snowman Merkle Airdrop
Submissions
AI First Flight
Snowman Merkle Airdrop
AI First Flight #10
Beginner Friendly
Foundry
Solidity
NFT
EXP
AI First Flight
EXP
Aug 3rd, 2026 → Aug 8th, 2026
View repo
View results
10 / 10
Submissions
Severity
Validity
Tags
Author
#1
Unchecked return value on WETH transfer in `Snow::collectFee` can silently fail and leave fees stuck in the contract
Low
Invalid
sebidelamata
#2
`Snowman::mintSnowman` has no access control, allowing anyone to mint unlimited Snowman NFTs without going through the `SnowmanAirdrop` merkle/signature verification
High
Valid
[H-01] Unrestricted NFT Min...
sebidelamata
#3
Signature and merkle proof replay in claimSnowman() allows unlimited repeated claims for any address that reacquires its original SNOW balance
Low
Valid
[L-01] Missing Claim Status...
sebidelamata
#4
`Snow::changeCollector` has no owner override, allowing the collector role to permanently and irrecoverably brick fee collection
Medium
Invalid
sebidelamata
#5
State variables in the `Snow.sol` contract are not designated as immutable, costing more gas for functions that use the variable
Low
Invalid
sebidelamata
#6
`SnowmanAirdrop::claimSnowman` derives amount from live SNOW balance instead of the merkle-snapshotted value, causing legitimate claims to revert for any user whose balance has changed since snapshot
Medium
Valid
[M-01] DoS to a user trying...
sebidelamata
#7
`Snow::s_earnTimer` is a single global variable instead of per-address, causing `earnSnow` and `buySnow` to lock out all other users for a week after any single call
Low
Valid
[L-02] Global Timer Reset i...
sebidelamata
#8
Misspelled EIP-712 type signature in MESSAGE_TYPEHASH breaks compatibility with spec-compliant off-chain signing tools
High
Valid
[H-02] Unconsistent `MESSAG...
sebidelamata
#9
`Snow::SnowEarned` and `Snow::FeeCollected` events are declared but never emitted
Low
Invalid
sebidelamata
#10
`SnowmanAirdrop` constructor does not validate `_merkleRoot != bytes32(0)`, risking a permanently non-functional airdrop if misconfigured at deployment
Low
Invalid
sebidelamata
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
