Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

No Zero Address Check for BeatToken

r4y4n3

Root + Impact

Description

  • The constructor of FestivalPass does not validate that the beatToken address is nonzero. If the owner or deployer sets beatToken to the zero address (either accidentally or maliciously), all BEAT token minting and burning operations will fail. This bricks core contract features, including:

    • Distributing BEAT token rewards for attending performances

    • Granting BEAT token bonuses for VIP/BACKSTAGE pass purchases

    • Redeeming memorabilia (which burns BEAT tokens)

// FestivalPass.sol
constructor(address _beatToken, address _organizer) ERC1155("ipfs://beatdrop/{id}") Ownable(msg.sender){
@> setOrganizer(_organizer);
@> beatToken = _beatToken;
}

Risk

Likelihood:

  • If beatToken is set to zero, all BEAT-related features are permanently disabled. Users cannot receive rewards, bonuses, or redeem memorabilia.

  • The project loses its main utility and value proposition.

Impact:

  • This can occur due to a deployment mistake, misconfiguration, or malicious intent.

Proof of Concept

If beatToken is set to zero, any call to a function that tries to mint or burn BEAT tokens will revert or have no effect.

festival = new FestivalPass(address(0), organizer);
// Any call to festival.buyPass or festival.attendPerformance will fail when trying to mint BEAT tokens.

Recommended Mitigation

The proposed fix—adding a zero-address check in the constructor—is correct and practical. The provided diff clearly shows the changes needed to prevent the issue.

- constructor(address _beatToken, address _organizer) ERC1155("ipfs://beatdrop/{id}") Ownable(msg.sender){
- setOrganizer(_organizer);
- beatToken = _beatToken;
- }
+ constructor(address _beatToken, address _organizer) ERC1155("ipfs://beatdrop/{id}") Ownable(msg.sender){
+ require(_beatToken != address(0), "Invalid BEAT token address");
+ require(_organizer != address(0), "Invalid organizer address");
+ setOrganizer(_organizer);
+ beatToken = _beatToken;
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Zero address check

Owner/admin is trusted / Zero address check - Informational

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.