Beatland Festival

Description:

The configurePass function allows the organizer to modify pass prices at any time without protection against front-running attacks. When an organizer wants to increase the price of a pass, malicious users can monitor this transaction in the mempool and execute a front-running attack by purchasing passes at the old, lower price before the price change transaction is mined.

Attack path:

1. Organizer calls configurePass(GENERAL_PASS, 0.1 ether, 5000) to increase price from 0.05 ETH to 0.1 ETH

2. Attacker observes this transaction in the mempool

3. Attacker quickly submits buyPass(GENERAL_PASS) with 0.05 ETH (old price) and higher gas price

4. Attacker's transaction executes first - they purchase pass for 0.05 ETH

5. Organizer's transaction then executes, setting new price to 0.1 ETH

6. Protocol loses 0.05 ETH difference in pricing

Impact:

• Financial losses for the protocol with every price increase

• Loss of pricing control and predictability

Recommended Mitigation:

Use commit-reveal scheme to hide price change intentions