Reentrancy

Description

• The redeemMemorabilia()function may be vulnerable to reentrancy attacks if external contracts (like a malicious token) are allowed to call back into it.

  In this case, the contract burns a BEAT token via:

If burnFrom() is overridden in a malicious token contract, it can call back into redeemMemorabilia() again before the function finishes — allowing multiple redemptions or bypassing conditions like maxSupply.

Risk

Likelihood:

• Without a nonReentrant modifier, an attacker could:

  • Call redeemMemorabilia()

  • Use a malicious burnFrom() to call it again before currentItemId++ is updated

  • Mint more NFTs than allowed or drain other logic

Proof of Concept

The attacker replaces the real BEAT token with a malicious one:

In a test, calling redeemMemorabilia(0) causes the contract to call it again via burnFrom() — simulating a reentrancy attack.

Recommended Mitigation

Apply the OpenZeppelin ReentrancyGuard and use the nonReentrant modifier: