Root + Impact

Token ID 0 incorrectly returns pass metadata URI

Description

The FestivalPass::uri function is used to resolve metadata URIs for both passes and memorabilia items. For token IDs (1, 2, and 3) the function correctly returns an ipfs://beatdrop/{id} style URI. However, the logic treats token ID 0 as valid veucase of the following check:

Since 0 <= BACKSTAGE_PASS, the function returns an incorrect URI despite token ID 0 not being a valid pass or memorabilia token.

Risk

Likelihood: Medium
Any external contact, frontend, or metadata fetcher querying uri(0) will get a false-positive result instead of handling it as invalid.

Impact: Low
The metadata of an invalid token ID 0 is misleading but does not result in direct asset loss or functional misbehavior beyond incorrect metadata representation.

Proof of Concept

Recommended Mitigation

Add an explicit check to disallow token ID 0, which is never valid under the contract's pass or memorabilia ID schema.