Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Snowman Merkle Airdrop
Submissions
AI First Flight
Snowman Merkle Airdrop
AI First Flight #10
Beginner Friendly
Foundry
Solidity
NFT
EXP
AI First Flight
EXP
Sep 26th, 2026 → Sep 26th, 2026
View repo
View results
6 / 6
Submissions
Severity
Validity
Tags
Author
#1
Snowman NFTs can be minted for free by anyone due to missing access control on `Snowman.mintSnowman()`, completely bypassing the stake-Snow-for-NFT mechanism
High
Valid
[H-01] Unrestricted NFT Min...
sillyrobot796
#2
Global `s_earnTimer` cooldown in `Snow` allows anyone to zero-cost DoS `earnSnow()` for all users
Low
Valid
[L-02] Global Timer Reset i...
sillyrobot796
#3
`Snow.buySnow()` uses `==` for the ETH payment check, so a 1-wei miscalculation charges the user full WETH and permanently sweeps their ETH to the collector
Medium
Invalid
sillyrobot796
#4
`claimSnowman()` never checks `s_hasClaimedSnowman` and the signed message carries no nonce, so one signature replays into repeated NFT claims
Low
Valid
[L-01] Missing Claim Status...
sillyrobot796
#5
Merkle leaf and EIP-712 amounts are read from the live `balanceOf` instead of the snapshot, so any balance change permanently bricks the user's claim
Medium
Valid
[M-01] DoS to a user trying...
sillyrobot796
#6
Snow pulled into `SnowmanAirdrop` on claim has no exit path — it is locked forever while still counted in `totalSupply`
Medium
Invalid
sillyrobot796
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
