Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

BEATLAND FESTIVAL BeatToken.sol CONTRACT AUDIT VULNERABILITY FINDINGS

3ric3mmanu3l

Root + Impact

Description

  1. festivalContract in BeatToken.sol can only be set once within the contract . In future , when there is something like ..lets say an upgrade or a someone makes a mistake when deploying the contract to a blockchain , the contract becomes obsolete and will not be able to be used.



Risk

Likelihood:

  • The likelihood is medium because it is a config function that's only called once by the owner of the contract

  • When the address needs to be changed in future it cant be undone and this can cause quite a problem

Impact:

  • The impact is high because ,since festivalContract can only be set once in BeatToken.sol , if it is misconfigured in any way , then no one can/will be able to mint and/or burn the tokens anymore

  • Since no tokens will be minted anymore ,this will hinder the main /core function of the token , most importantly if the main token function is tied to very important activities in the festival such as redeeming tickets

Proof of Concept

// Lets say for example this is called during deployment:
​
beatToken.setFestivalContract(address(0xABC));
​
//Please note that the above is a config made by mistake ...
​
// Then I realise ,oh crap , i made a mistake!!! I need to fix this ...so i set the address to a correct one
​
beatToken.setFestivalContract(address(0x123));
// Then the terminal in remix reverts to "festival contract is already set"
​
// The contract becomes obsolete now unless a new contract is deployed

Recommended Mitigation

- function setFestivalContract(address _festival) external onlyOwner {
require(festivalContract == address(0), "Festival contract already set");
+ event FestivalContractSet(address indexed newFestivalContract);
event FestivalContractLocked();
​
function setFestivalContract(address _festival) external onlyOwner {
require(!festivalContractLocked, "Festival contract is permanently locked");
festivalContract = _festival;
emit FestivalContractSet(_festival);
}
​
function lockFestivalContract() external onlyOwner {
require(festivalContract != address(0), "Festival contract not set yet");
festivalContractLocked = true;
emit FestivalContractLocked();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 27 days ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

`setFestivalContract` only callable once

This is intended. It's done like that because the festival contract requires beat token's address and vice versa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.