Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Snowman Merkle Airdrop
Submissions
AI First Flight
Snowman Merkle Airdrop
AI First Flight #10
Beginner Friendly
Foundry
Solidity
NFT
EXP
AI First Flight
EXP
Aug 1st, 2026 → Aug 1st, 2026
View repo
View results
7 / 7
Submissions
Severity
Validity
Tags
Author
#1
Missing access control in Snowman::mintSnowman lets any address mint unlimited Snowman NFTs without staking Snow, making the entire Merkle airdrop worthless
High
Valid
[H-01] Unrestricted NFT Min...
hati
#2
Missing access control in Snowman::mintSnowman lets any address mint unlimited Snowman NFTs without staking Snow, making the entire Merkle airdrop worthless
High
Valid
[H-01] Unrestricted NFT Min...
hati
#3
Root cause: claimSnowman never reads s_hasClaimedSnowman and the signed message carries no nonce. Impact: an eligible address replays one signature to mint Snowman NFTs far beyond its snapshot entitlement
Low
Valid
[L-01] Missing Claim Status...
hati
#4
Root cause: MESSAGE_TYPEHASH misspells the EIP-712 type string as addres and adds spaces. Impact: signatures produced by standard wallets never validate, so eligible users cannot claim their Snowman
High
Valid
[H-02] Unconsistent `MESSAG...
hati
#5
Root cause: claimSnowman rebuilds the Merkle leaf from the live balanceOf instead of the snapshot amount. Impact: any balance change after the snapshot permanently voids an eligible user's claim
Medium
Valid
[M-01] DoS to a user trying...
hati
#6
Root cause: s_earnTimer is a single protocol-wide variable instead of per user. Impact: one address takes the entire free Snow supply, or freezes weekly farming for everybody at zero cost
Low
Valid
[L-02] Global Timer Reset i...
hati
#7
Root cause: five defects across Snow, Snowman and the in-scope scripts. Impact: buyers silently lose ETH to the collector, fees can be stranded permanently, large claims are unexecutable, and contract wallets can never claim
Low
Invalid
hati
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
