Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Irreversible Festival Contract Assignment Limits Upgradeability

geeby

Root + Impact

Description

  • Describe the normal behavior in one or more sentences

the festivalContract should have flexible upgradeability, the owner may want to update it across different festivals or deployments.

  • Explain the specific issue or problem in one or more sentences

once festivalContract is set, it becomes immutable, preventing future upgrades or fixes even by the owner.

function setFestivalContract(address _festival) external onlyOwner {
@> require(festivalContract == address(0), "Festival contract already set");
festivalContract = _festival;
}
​

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

Happens on the first call to setFestivalContract.

  • Reason 2

No ability to recover or update the contract reference after that point.

Impact:

  • Impact 1

Project cannot upgrade to future festival contracts.

  • Impact 2

  • Bugs or logic errors in the first set contract become permanent.


Proof of Concept

The contract allows the festivalContract address to be set only once. After the initial assignment, any attempt to change it again reverts with "Festival contract already set". This permanently locks the BeatToken contract to the first assigned festival, preventing upgrades or migration to new festival contracts.

// Step 1: Owner sets festival contract once
beatToken.setFestivalContract(address(festivalV1));
​
// Step 2: Tries to set new one later
beatToken.setFestivalContract(address(festivalV2)); // Fails: "Festival contract already set"
​

Recommended Mitigation

If future upgrades are needed, remove the one-time require check and allow the owner to update the festivalContract anytime. Just ensure the new address is valid (non-zero) to prevent setting it to an invalid contract.

- remove this code
require(festivalContract == address(0), "Festival contract already set");
+ add this code
require(_festival != address(0), "Invalid address");
festivalContract = _festival;
Updates

Lead Judging Commences

inallhonesty Lead Judge 29 days ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

`setFestivalContract` only callable once

This is intended. It's done like that because the festival contract requires beat token's address and vice versa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.