Top Tweets for #Codehawks
#codehawks #audit #defi #study
My first competitive audit. Submitted as HIGH, came back as LOW. That stung for about ten minutes — then I re-read the judge's reasoning and they were right.
By @CodeHawks.
Attaching the report in case it helps anyone starting out. One finding, one lesson: severity is not about what can happen, it's about what will happen.
More to come.
It's a little sad..
SweepUnclaimedBonus_Drains_Attacker
## Summary
A permissionless `sweepUnclaimedBonus()` between a moderator's `SURVIVED` flag and a corrective `CORRUPTED` re-flag irreversibly drains the bonus to `recoveryAddress`, permanently reducing the whitehat attacker's bounty. The protocol pays the wrong recipient with no recovery path.
## Description
`sweepUnclaimedBonus` does not set `claimsStarted` (L503), so the re-flag window stays open after the sweep. When `riskWindowStart == 0`, bonus is unreserved and fully sweepable (L483-487). On re-flag, the snapshot captures the now-zeroed `totalBonus` (L358), producing a reduced `bountyEntitlement`:
```solidity
// ConfidencePool.sol L357-362
snapshotTotalBonus = totalBonus; // captures zeroed value after sweep
bountyEntitlement = willBeGoodFaithCorrupted
? snapshotTotalStaked + snapshotTotalBonus // bonus portion is zero
: 0;
```
Because the snapshot occurs after the sweep, no later code path restores the swept bonus into `bountyEntitlement`.
**Reachability of `riskWindowStart == 0`:** The registry requires `UNDER_ATTACK` before `CORRUPTED` (`AttackRegistry.sol` L324). But the pool only seals `riskWindowStart` on a pool-touching transaction (L793). If `approveAttack()` and `markCorrupted()` execute with no pool interaction in between (e.g., same block), `riskWindowStart` stays zero.
## Vulnerability Details
**Attack path:**
1. Registry reaches `CORRUPTED` with no pool interaction during `UNDER_ATTACK` — `riskWindowStart` stays zero.
2. Moderator flags `SURVIVED`. No call to `stake()`, `contributeBonus()`, or `pokeRiskWindow()` occurred during the active-risk interval.
3. Anyone calls `sweepUnclaimedBonus()` — bonus drains to `recoveryAddress`, `totalBonus` zeroed.
4. `claimsStarted` remains false — moderator re-flags to good-faith `CORRUPTED`.
5. `bountyEntitlement = snapshotTotalStaked + 0`. Attacker permanently loses the bonus portion.
## Risk
**Impact: High** — The protocol permanently pays the wrong recipient. The bonus (up to 100% of `totalBonus`) is irreversibly sent to `recoveryAddress` instead of the named whitehat attacker. The loss is bounded only by the bonus pool size and is independent of the attacker's exploit performance.
**Likelihood: Medium** — Requires a rare but valid registry path where the pool does not observe the active-risk window before `CORRUPTED`, combined with a moderator flag correction. The sweep is permissionless and trivially automatable by a MEV bot.
## Impact
The whitehat attacker permanently loses their bonus entitlement. In the PoC, the attacker receives 150 tokens instead of the expected 200 — a 25% loss. The swept bonus sits irreversibly at `recoveryAddress`. No re-flag, no subsequent call, and no admin action can restore it into the attacker's `bountyEntitlement`.
## Proof of Concept
Drop into `test/unit/` and run: `forge test --match-test testSweepBetweenFlagsReducesAttackerBounty -vvvv`
The PoC uses `MockAttackRegistry` (same test double used by all 256 official tests) to stage the `CORRUPTED` state. In production this is reached via `approveAttack()` → `markCorrupted()` with no pool interaction in between.
```solidity
// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
import {IAttackRegistry} from "@battlechain/interface/IAttackRegistry.sol";
import {PoolStates} from "src/libraries/PoolStates.sol";
import {BaseConfidencePoolTest} from "test/helpers/BaseConfidencePoolTest.sol";
contract PoC_SweepDrainsBounty is BaseConfidencePoolTest {
function testSweepBetweenFlagsReducesAttackerBounty() external {
_stake(alice, 100 * ONE);
_stake(bob, 50 * ONE);
_contributeBonus(carol, 50 * ONE);
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
assertEq(pool.riskWindowStart(), 0);
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
pool.sweepUnclaimedBonus();
assertEq(pool.totalBonus(), 0);
assertFalse(pool.claimsStarted());
assertEq(token.balanceOf(recovery), 50 * ONE);
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
assertEq(pool.bountyEntitlement(), 150 * ONE); // should be 200
vm.prank(attacker);
pool.claimAttackerBounty();
assertEq(token.balanceOf(attacker), 150 * ONE);
assertEq(token.balanceOf(recovery), 50 * ONE);
}
}
```
## Tools Used
Manual review, Foundry
## Recommended Mitigation
Gate `sweepUnclaimedBonus` on `claimsStarted`:
```diff
function sweepUnclaimedBonus() external nonReentrant {
if (outcome != PoolStates.Outcome.SURVIVED && outcome != PoolStates.Outcome.EXPIRED) {
revert OutcomeNotEligibleForSweep();
}
+ if (!claimsStarted) revert OutcomeNotEligibleForSweep();
```
Alternatively, freeze `totalBonus` at the first `flagOutcome` and never re-snapshot it on re-flag, decoupling the sweep's accounting from the re-flag's snapshot.
Today's takeaway:
- Build the map before you hunt the bugs.
- Read what the spec says should be true, then check if the code actually enforces it.
- The gaps between "should" and "does" , that's where the findings live.
👇🏻Repo: https://t.co/a2IN7SJ3ki
#Web3 #CodeHawks
🛡️Day 22 of Becoming SR:@CodeHawks Hawk High
1️⃣Just read the code against the spec
2️⃣7 invariants broken from the mental model alone
3️⃣Teachers get 35% EACH instead of sharing 35%
4️⃣No review count check
5️⃣Storage layout shifted
👇🏻Repo: https://t.co/a2IN7SJ3ki
#Web3 #CodeHawks
Starting CodeHawks First Flight #54 in 1 minute — Token-0x 🛡️🚀
ERC20 audit challenge. Let’s fly.
#DeFi #SmartContracts #Audit #CodeHawks
📅 Day 16 of my smart contract auditing journey
✅ Submitted my first CodeHawks report (PizzaDrop – First Flights)
✅ Reported a vulnerability with PoC + mitigation
🔒 Full breakdown coming after the contest ends
#Web3Security #SmartContracts #CodeHawks
🚀 Completed my first CodeHawks Test Flight!
Submitted 2 findings — both validated as Medium ✅
Huge thanks to @cyfrinUpdraft & @PatrickAlphaC for building such an awesome platform to learn & grow 🙌
Onward to more hunts 🦅
#CodeHawks #Web3Security #SmartContractAuditing
7/ 🏴☠️ What's next?
I'll be ramping up for competitive audits on platforms like @CodeHawks , where real-world security meets real incentives.
Stay tuned for more audits, more learning, and more impact 🚀
#SmartContracts #Security #Web3 #AuditJourney #Updraft #CodeHawks
Day 23 of #100DaysOfCode
[✅] Found a critical vuln in the OrderBook after hours of digging 🐶🔍
Now praying it gets accepted...
[404 ⛔️]
“This was that easy?”
– said me, 6 hours too late.
#Web3Security #Audit #CodeHawks #BuildInPublic #SmartContracts
![0xPexy's tweet photo. Day 23 of #100DaysOfCode
[✅] Found a critical vuln in the OrderBook after hours of digging 🐶🔍
Now praying it gets accepted...
[404 ⛔️]
“This was that easy?”
– said me, 6 hours too late.
#Web3Security #Audit #CodeHawks #BuildInPublic #SmartContracts https://t.co/UttEQna5rW](https://pbs.twimg.com/media/GvUIPPrXMAAb2dD.jpg)
![0xPexy's tweet photo. Day 23 of #100DaysOfCode
[✅] Found a critical vuln in the OrderBook after hours of digging 🐶🔍
Now praying it gets accepted...
[404 ⛔️]
“This was that easy?”
– said me, 6 hours too late.
#Web3Security #Audit #CodeHawks #BuildInPublic #SmartContracts https://t.co/UttEQna5rW](https://pbs.twimg.com/media/GvUHdMCbAAA_KUB.png)
CLIMBED TO 3RD PLACE on the @CodeHawks First Flight Hawk High leaderboard!
The grind pays off! Each audit taught me something new about smart contract security. Grateful for the @PatrickAlphaC ecosystem that makes learning this accessible.
#CodeHawks #Web3 #SmartContractAudit
Just secured 4th place on the leaderboard in @CodeHawks First Flight Hawk High🔥
Huge thanks to @PatrickAlphaC for creating such an amazing learning platform. The auditing challenges really pushed my skills to the next level!
#CodeHawks #SmartContractSecurity #Web3Security #First
Thrilled to have participated in @codehawks first flight! The experience was amazing and I'm even more excited to join upcoming contests in @cantina. #CodeHawks #WebSecurity #BugBounty
The results are finally out — secured 4th place in the Curve contest on CodeHawks🔥
Huge thanks to @CodeHawks for hosting these awesome competitions — always a great experience.
#CodeHawks #Optimism #Web3
Day 4/100 #CodeHawks First Flight: Guardian Vault
Finally done with this First Flight...
I learned a lot about ERC-4626 implementation and it's disadvantages.
Ready to learn more ⭐️
Next: Something more hardcore 🌩️
Day 3/100 #CodeHawks First Flight: Guardian Vault
Today was a busy day didn't work much.
Final Boss Mood: 😤 "Tomorrow, we ride at dawn." 🚀
Day 2/100 #CodeHawks First Flight: Guardian Vault
🔍 Today’s Mission:
- Fixed critical slippage bug
- Understood @Uniswap V2 and @aave V3
- Learned how sandwich attacks works
🔓Unlocked:
A newfound hatred for amountOutMin: 0
Next : Finishing this in Day 3.
Achivement added Just found 2 high-severity vulnerabilities in the @CyfrinAudit CodeHawks – First Flight Challenge
Ranked #998 globally among elite Web3 security researchers!
#CodeHawks #Web3Security #SmartContractAudit #Bugbointy #BlockchainSecurity #CTF #EthicalHacking #cyfrin
🚀 First Submission as a Smart Contract Security Researcher at @CodeHawks ! 🔍
🔗 Check it out: https://t.co/F6gdQbBBAs
Open to Blockchain Developer & Security Researcher roles! 🚀
#Solana #BlockchainSecurity #SmartContracts #Rust #Web3 #CyberSecurity #CodeHawks
Baby steps, Alhamdulillah I was able to discover vulnerabilities on codehawks first flights.
I don't care if it's valid or not, at least I was able to learn.
#Codehawks
#Cyfrin
اگه به فکر سلامت جسم و روحتون هستید سمت audit (وب۳) برید، پول خوبی داره بعدا باهاش میرید تراپی.
#sherlock #codehawks #code4rena
اگه به فکر سلامت جسم و روحتون هستید سمت بک اند اصلا نیایید و فقط فرار کنید
I made 100 $/h in this #audt. Cool number.
Again in the top 10 -> this time top 7 shared with 2 more peers. On @Sablier contest at @CodeHawks .
Consistently in the high ranking numbers in recent contests, slowly but surely. #web3audit #web3 #codehawks
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.6M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.1M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
89.9M followers
Taylor Swift
@taylorswift13
83.8M followers
Lady Gaga
@ladygaga
75.3M followers
Virat Kohli
@imvkohli
73.1M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.1M followers
Bill Gates
@billgates
65M followers
Selena Gomez
@selenagomez
62.9M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers