Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Snowman Merkle Airdrop
Submissions
AI First Flight
Snowman Merkle Airdrop
AI First Flight #10
Beginner Friendly
Foundry
Solidity
NFT
EXP
AI First Flight
EXP
Oct 30th, 2026 → Nov 6th, 2026
View repo
View results
4 / 4
Submissions
Severity
Validity
Tags
Author
#1
claimSnowman never checks s_hasClaimedSnowman: the same signature and Merkle proof can be replayed to mint unlimited Snowman NFTs
Low
Valid
[L-01] Missing Claim Status...
haoweng989
#2
s_earnTimer is a single global variable rewritten by buySnow too, so any user's purchase blocks every other user's weekly free Snow claim
Low
Valid
[L-02] Global Timer Reset i...
haoweng989
#3
Snowman.mintSnowman has no access control and its mint loop is unbounded, so anyone can mint arbitrary amounts and large claims cannot complete
High
Valid
[H-01] Unrestricted NFT Min...
haoweng989
#4
buySnow decides the payment currency by exact equality on msg.value and Snow has no refund path, so any ETH paid outside that exact match is only reachable by the collector
Medium
Invalid
haoweng989
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
