Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Reconfiguring passes does not affect current circulation resulting in state inconsistency

fredo182

Root + Impact

Reconfiguring passes does not affect current circulation resulting in state inconsistency.

Description

The configurePass allows the organizer to update the price, maximum supply, and current supply of various pass types. Howeve, when resetting, old passes are not invalidated, meaning that the can still be used despite having their supply reset. The issue arises because the state of the ERC1155 token is not updated by burning the old passes.

// src/FestivalPass.sol
@> passMaxSupply[passId] = maxSupply;
@> passSupply[passId] = 0; // Reset current supply
// @audit: No invalidation/burning of the previously minted passes.

Risk

Likelihood: Medium
The issue arises whenever the organizer updates the configuration of passes.

Impact: High
The contract's state becomes incosistent as the reset supply does not match the actual number of passes in circulation.

Proof of Concept

function test_inconsistenSupplyAndCirculation() public {
vm.prank(user1);
vm.expectEmit(true, true, false, true);
emit PassPurchased(user1, 1);
festivalPass.buyPass{value: GENERAL_PRICE}(1);
​
vm.prank(user2);
vm.expectEmit(true, true, false, true);
emit PassPurchased(user2, 1);
festivalPass.buyPass{value: GENERAL_PRICE}(1);
​
assertEq(festivalPass.balanceOf(user1, 1), 1);
assertEq(festivalPass.balanceOf(user2, 1), 1);
assertEq(festivalPass.passSupply(1), 2);
​
vm.prank(organizer);
festivalPass.configurePass(1, GENERAL_PRICE, 1); // Set max supply to 1
assertEq(festivalPass.balanceOf(user1, 1), 1);
assertEq(festivalPass.balanceOf(user2, 1), 1);
assertEq(festivalPass.passSupply(1), 0);
}

Recommended Mitigation

- passSupply[passId] = 0; // Reset current supply
+ passSupply[passId] = 0; // Reset current supply
+ // Implement burn or invalidate all previously minted passes of this type
+ _burnAllPreviousPasses(passId);
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

configurePass resets the current pass supply circumventing the max supply check

This is not acceptable as high because any attack vectors related to organizer trying to milk ETH from participants is voided by the fact that the organizer is trusted.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.