Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Broken Access Control on the getMemorabiliaDetails() function

hackerjedi2812

Root + Impact

Description

  • The mint() and withdraw() functions allow direct execution of sensitive actions—minting BeatTokens and withdrawing ETH from the contract's balance. These actions should typically be restricted to the contract owner or authorized addresses only.

  • However, the contract lacks any onlyOwner or equivalent access control checks, allowing any external user to arbitrarily call these functions and perform privileged actions, including draining all ETH or inflating the token supply.


Root Cause:

function redeemMemorabilia(uint256 collectionId) external {
MemorabiliaCollection storage collection = collections[collectionId];
require(collection.priceInBeat > 0, "Collection does not exist");
require(collection.isActive, "Collection not active");
require(collection.currentItemId < collection.maxSupply, "Collection sold out");
@> BeatToken(beatToken).burnFrom(msg.sender, collection.priceInBeat);
uint256 itemId = collection.currentItemId++;
uint256 tokenId = encodeTokenId(collectionId, itemId);
tokenIdToEdition[tokenId] = itemId;
@> _mint(msg.sender, tokenId, 1, ""); // No role check before minting
emit MemorabiliaRedeemed(msg.sender, tokenId, collectionId, itemId);
}
​

Risk

Likelihood:

  • This will occur whenever an attacker obtains BEAT tokens and calls redeemMemorabilia(). No additional constraints exist to limit usage, such as whitelisting, claim windows, or role verification.

Impact:

  • Unauthorized users can burn acquired BEAT tokens (even stolen or bought cheaply) and mint limited edition memorabilia NFT.

Proof of Concept

// Attacker contract or EOA code
function attack() external {
// Assume attacker has some BEAT tokens approved to this contract
uint256 collectionId = 1;
// Call the vulnerable function
FestivalContract.redeemMemorabilia(collectionId);
// Attacker now owns a limited edition NFT
}

Recommended Mitigation

Role-based Access Control (RBAC):

  • Introduce onlyOwner modifiers for sensitive minting operations if needed.

Add Usage Constraints:

  • Implement redemption windows, time locks, or allowlists.

  • Track redemptions per address to limit abuse.

- function redeemMemorabilia(uint256 collectionId) external {
+ function redeemMemorabilia(uint256 collectionId) external onlyOwner {
Updates

Lead Judging Commences

inallhonesty Lead Judge 24 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.