Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Snowman Merkle Airdrop
Submissions
AI First Flight
Snowman Merkle Airdrop
AI First Flight #10
Beginner Friendly
Foundry
Solidity
NFT
EXP
AI First Flight
EXP
Nov 3rd, 2026 → Nov 7th, 2026
View repo
View results
6 / 6
Submissions
Severity
Validity
Tags
Author
#1
Missing access control in Snowman.mintSnowman lets anyone mint unlimited Snowman NFTs for free, with no Snow staked behind them
High
Valid
[H-01] Unrestricted NFT Min...
casperdaghoxt
#2
Malformed EIP-712 typehash in SnowmanAirdrop.MESSAGE_TYPEHASH makes every standard typed-data wallet signature fail, so holders can't claim through the standard signing flow
High
Valid
[H-02] Unconsistent `MESSAG...
casperdaghoxt
#3
SnowmanAirdrop.claimSnowman never checks s_hasClaimedSnowman, so a listed account claims again and again past its allocation, and anyone can replay a used signature to lock a holder's later Snow
Low
Valid
[L-01] Missing Claim Status...
casperdaghoxt
#4
Snow.buySnow treats any msg.value other than the exact price as a WETH purchase and keeps the ETH, so a buyer with a standing WETH allowance is charged the full price in WETH on top of the ETH they sent
Low
Invalid
casperdaghoxt
#5
Snow.buySnow resets the earn timer on every purchase, even buySnow(0) with no ETH, so ordinary purchases or one free call per week stop anyone from ever earning Snow
Low
Valid
[L-02] Global Timer Reset i...
casperdaghoxt
#6
Snow.s_earnTimer is one contract-wide value, so one address's earnSnow blocks every other address for a week and all users combined can earn at most 12 Snow over the whole farming window
Low
Valid
[L-02] Global Timer Reset i...
casperdaghoxt
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
