Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Constructor Implementation Issues: Improper ERC1155 URI handling and missing input validation

jamiebones147

Root + Impact

Description

The FestivalPass contract constructor has several implementation issues that affect functionality and security. The constructor passes an IPFS URI template with {id} placeholder to the ERC1155 parent constructor, but this conflicts with the custom uri() function override that builds URIs from scratch. Additionally, the constructor lacks input validation for critical parameters, allowing zero addresses to be set for essential contract dependencies.

​

Risk

Likelihood:

  • This will occur when the contract is deployed.

Impact:

  • URI inconsistency may cause metadata resolution issues for NFT marketplaces and wallets

  • Zero address parameters can break contract functionality, making the contract unusable

  • The conflicting URI patterns create confusion and potential integration problems

Proof of Concept

The POC shows the constructor code that attempts to construct the URL of the ERC1155 token. Deployment with zero addresses would succeed but break functionality:\

// Current problematic constructor
constructor(address _beatToken, address _organizer) ERC1155("ipfs://beatdrop/{id}") Ownable(msg.sender){
setOrganizer(_organizer); // No zero address check
beatToken = _beatToken; // No zero address check
}
​
// The ERC1155 constructor URI is ignored by the uri() override:
function uri(uint256 tokenId) public view override returns (string memory) {
if (tokenId <= BACKSTAGE_PASS) {
return string(abi.encodePacked("ipfs://beatdrop/", Strings.toString(tokenId), ".json"));
}
}
// Deployment with zero addresses would succeed but break functionality:
FestivalPass pass = new FestivalPass(address(0), address(0));
​

Recommended Mitigation

  1. Use an empty string in the ERC1155 constructor since the uri() function handles all URI logic

  2. Add comprehensive input validation for all constructor parameters

  3. Update the setOrganizer function to also include zero address validation.

- remove this code
constructor(address _beatToken, address _organizer) ERC1155("ipfs://beatdrop/{id}") Ownable(msg.sender){
setOrganizer(_organizer);
beatToken = _beatToken;
}
+ add this code
constructor(address _beatToken, address _organizer) ERC1155("") Ownable(msg.sender) {
setOrganizer(_organizer);
beatToken = _beatToken;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Zero address check

Owner/admin is trusted / Zero address check - Informational

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.