Submission Details
Impact:
Likelihood:
Unlimited Bonus Minting in `buyPass()`
Description
Buying multiple passes of same type grants repeated bonuses.
Risk
Likelihood:
-
Trivial to exploit—just call
buyPass()repeatedly. -
No special conditions needed.
Impact:
Token inflation
economic system collapse
Proof of Concept
function test_BonusExploit() public {
uint256 passPrice = festivalPass.passPrice(VIP_PASS);
// Buy 10 VIP passes
for (uint i; i < 10; i++) {
vm.deal(user, passPrice);
vm.prank(user);
festivalPass.buyPass{value: passPrice}(VIP_PASS);
}
// User gets 50 BEAT (5x10) instead of 5
assertEq(beatToken.balanceOf(user), 50e18);
}
Recommended Mitigation
+ mapping(address => mapping(uint256 => bool)) public hasReceivedBonus;
function buyPass(uint256 passId) external payable {
// ...
+ if (bonus > 0 && !hasReceivedBonus[msg.sender][passId]) {
+ hasReceivedBonus[msg.sender][passId] = true;
+ BeatToken(beatToken).mint(msg.sender, bonus);
}
}
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.