Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Snowman Merkle Airdrop
Submissions
AI First Flight
Snowman Merkle Airdrop
AI First Flight #10
Beginner Friendly
Foundry
Solidity
NFT
EXP
AI First Flight
EXP
Oct 10th, 2026 → Oct 12th, 2026
View repo
View results
10 / 10
Submissions
Severity
Validity
Tags
Author
#1
Unauthenticated `Snowman::mintSnowman` lets anyone mint unlimited Snowman NFTs, bypassing the Merkle proof, the signature check and the Snow staking requirement entirely
High
Valid
[H-01] Unrestricted NFT Min...
friedsocks233
#2
`s_hasClaimedSnowman` is written but never read and the signed digest has no nonce, so a whitelisted address can replay the same proof and signature to claim the airdrop an unlimited number of times
Low
Valid
[L-01] Missing Claim Status...
friedsocks233
#3
Claim amount is derived from the live Snow balance instead of the Merkle-committed snapshot, so one unit of dust blocks a whitelisted claim and simply using `earnSnow` as intended invalidates a user's own proof
Medium
Valid
[M-01] DoS to a user trying...
friedsocks233
#4
`Snow::s_earnTimer` is a single global cooldown rather than per-user, and a zero-cost `buySnow(0)` call resets it, letting anyone permanently disable free weekly Snow farming for every user at gas cost
Low
Valid
[L-02] Global Timer Reset i...
friedsocks233
#5
`Snow::buySnow` treats any inexact `msg.value` as a WETH purchase, so it keeps the ETH the buyer attached and additionally charges the full price in WETH with no refund
Medium
Invalid
friedsocks233
#6
`MESSAGE_TYPEHASH` is not a valid EIP-712 `encodeType` string ("addres" typo plus spaces after commas), so no signature produced by a spec-compliant wallet can ever be accepted and the claim-on-behalf flow is unusable off-chain
High
Valid
[H-02] Unconsistent `MESSAG...
friedsocks233
#7
`Snow::collectFee` ignores the WETH transfer return value and force-pushes ETH behind a `require`, so fees can silently vanish and a collector that cannot receive ETH strands all accrued WETH as well
Low
Invalid
friedsocks233
#8
Both contracts inherit `Ownable` without defining a single `onlyOwner` function, leaving the self-perpetuating `s_collector` as the only privileged role, so a lost or hostile collector key permanently captures or bricks all protocol revenue
Low
Invalid
friedsocks233
#9
`Snowman::tokenURI`'s nonexistent-token guard is unreachable dead code because OpenZeppelin v5 `ownerOf` reverts instead of returning the zero address, so callers receive a different error than the contract declares
Low
Invalid
friedsocks233
#10
`SnowmanAirdrop::s_claimers` is declared with a comment promising a claimer registry but is never written or read, so the contract keeps no record of who claimed
Low
Invalid
friedsocks233
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
