diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index f5875d58..573080ce 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "2.28.5",
+    "version": "2.28.6",
     "bin": "bin/hydrooj.js",
     "main": "dist/loader.js",
     "typings": "dist/loader.d.ts",
diff --git a/packages/hydrooj/src/handler/contest.ts b/packages/hydrooj/src/handler/contest.ts
index dd89a62c..98fb5c7d 100644
--- a/packages/hydrooj/src/handler/contest.ts
+++ b/packages/hydrooj/src/handler/contest.ts
@@ -4,7 +4,7 @@ import AdmZip from 'adm-zip';
 import { Time } from '@hydrooj/utils/lib/utils';
 import {
     ContestNotLiveError, ValidationError, ProblemNotFoundError,
-    ContestNotAttendedError, PermissionError, BadRequestError,
+    ContestNotAttendedError, PermissionError, BadRequestError, ContestNotFoundError,
 } from '../error';
 import { ProblemDoc, Tdoc, User } from '../interface';
 import paginate from '../lib/paginate';
@@ -169,9 +169,10 @@ export class ContestEditHandler extends Handler {
     async prepare(domainId: string, tid: ObjectID) {
         if (tid) {
             this.tdoc = await contest.get(domainId, tid);
+            if (!this.tdoc) throw new ContestNotFoundError(domainId, tid);
             if (!this.user.own(this.tdoc)) this.checkPerm(PERM.PERM_EDIT_CONTEST);
             else this.checkPerm(PERM.PERM_EDIT_CONTEST_SELF);
-        }
+        } else this.checkPerm(PERM.PERM_CREATE_CONTEST);
     }
 
     @param('tid', Types.ObjectID, true)
@@ -394,7 +395,7 @@ export class ContestCodeHandler extends Handler {
 }
 
 export async function apply() {
-    Route('contest_create', '/contest/create', ContestEditHandler, PERM.PERM_CREATE_CONTEST);
+    Route('contest_create', '/contest/create', ContestEditHandler);
     Route('contest_main', '/contest', ContestListHandler, PERM.PERM_VIEW_CONTEST);
     Route('contest_detail', '/contest/:tid', ContestDetailHandler, PERM.PERM_VIEW_CONTEST);
     Route('contest_boardcast', '/contest/:tid/boardcast', ContestBoardcastHandler);
diff --git a/packages/hydrooj/src/handler/homework.ts b/packages/hydrooj/src/handler/homework.ts
index 743a679c..f3659b8a 100644
--- a/packages/hydrooj/src/handler/homework.ts
+++ b/packages/hydrooj/src/handler/homework.ts
@@ -5,7 +5,7 @@ import AdmZip from 'adm-zip';
 import { Time } from '@hydrooj/utils/lib/utils';
 import {
     ValidationError, HomeworkNotLiveError, ProblemNotFoundError,
-    HomeworkNotAttendedError, BadRequestError,
+    HomeworkNotAttendedError, BadRequestError, ContestNotFoundError,
 } from '../error';
 import {
     PenaltyRules, Tdoc, ProblemDoc, User,
@@ -250,7 +250,9 @@ class HomeworkEditHandler extends Handler {
         const tdoc = tid
             ? await contest.get(domainId, tid, document.TYPE_HOMEWORK)
             : null;
-        if (!this.user.own(tdoc)) this.checkPerm(PERM.PERM_EDIT_HOMEWORK);
+        if (tid && !tdoc) throw new ContestNotFoundError(domainId, tid);
+        else if (!tid) this.checkPerm(PERM.PERM_CREATE_HOMEWORK);
+        else if (!this.user.own(tdoc)) this.checkPerm(PERM.PERM_EDIT_HOMEWORK);
         else this.checkPerm(PERM.PERM_EDIT_HOMEWORK_SELF);
         const extensionDays = tid
             ? Math.round(
@@ -402,7 +404,7 @@ class HomeworkCodeHandler extends Handler {
 
 export async function apply() {
     Route('homework_main', '/homework', HomeworkMainHandler, PERM.PERM_VIEW_HOMEWORK);
-    Route('homework_create', '/homework/create', HomeworkEditHandler, PERM.PERM_CREATE_HOMEWORK);
+    Route('homework_create', '/homework/create', HomeworkEditHandler);
     Route('homework_detail', '/homework/:tid', HomeworkDetailHandler, PERM.PERM_VIEW_HOMEWORK);
     Route('homework_scoreboard', '/homework/:tid/scoreboard', HomeworkScoreboardHandler, PERM.PERM_VIEW_HOMEWORK_SCOREBOARD);
     Route(