# Crestal Network audit contest Sherlock · AI agent · 11th March 2025 · #1 A public audit contest on Sherlock (AI agent), completed on 11th March 2025. 0xSimao placed #1. 5 of his findings are published: 1 high severity and 4 medium. ## What Crestal Network is Crestal's Nation is a platform for productive AI agents: agents generate revenue, manage wallets and launch tokens, and the on-chain side handles the payments, escrow and rewards that let users commission agent work. ## Scope The platform's payment rails: deposits, escrow and withdrawals around agent services. ## High severity findings - [Anyone who is approving `BlueprintV5` contract to spend ERC20 can get drained because `Payment::payWithERC20`](https://0xsimao.com/findings/crestal-network-approving-blueprint-spend-erc20) ## Medium severity findings - [`createCommonProjectIDAndDeploymentRequest()` hardcodes request id index to 0, leading to lost requests for users](https://0xsimao.com/findings/crestal-network-common-project-hardcodes-index) - [Signatures missing some parameters being vulnerable to attackers using them coupled with malicious parameters](https://0xsimao.com/findings/crestal-network-signatures-parameters-them-coupled) - [Signature Replay attack possible on `updateWorkerDeploymentConfigWithSig()` in Blueprintcore.sol which leads to users lose the funds](https://0xsimao.com/findings/crestal-network-signature-replay-blueprintcore-lose) - [Worker-Induced Denial-of-Service in Deployment Requests Due to Lack of a Cancellation Mechanism](https://0xsimao.com/findings/crestal-network-worker-induced-denial-cancellation) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/755)