Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Reentrancy in FestivalPass.buyPass() Enables Double Spend / State Corruption

ishwar

Root Cause + Impact

Description

  • Normally, when a user buys a festival pass, payment is processed and a pass is minted with all state updated before any external call.

  • Here, _mint() (which triggers onERC1155Received) is called before updating passSupply, opening the function to reentrancy. A malicious receiver can re-enter buyPass and mint multiple passes for a single payment.

function buyPass(uint256 collectionId) external payable {
// ... (other checks)
_mint(msg.sender, collectionId, 1, ""); //@>
++passSupply[collectionId]; //@>
// ...
}

Risk

Likelihood:

  • Occurs whenever a malicious receiver contract is used.

  • ERC1155 hooks are a routine target for reentrancy.

Impact:

  • Multiple passes may be minted for one payment, draining ETH and corrupting accounting.

  • State may become permanently inconsistent or exploitable.

Proof of Code

contract EvilReceiver is IERC1155Receiver {
FestivalPass pass;
uint256 collectionId;
function attack() external {
pass.buyPass{value: pass.priceFor(collectionId)}(collectionId);
}
function onERC1155Received(...) external returns (bytes4) {
if (shouldReenter) {
pass.buyPass{value: pass.priceFor(collectionId)}(collectionId);
}
return IERC1155Receiver.onERC1155Received.selector;
}
}

Patch Mitigation

-function buyPass(uint256 collectionId) external payable {
- // ... (other checks)
- _mint(msg.sender, collectionId, 1, "");
- ++passSupply[collectionId];
- // ...
+function buyPass(uint256 collectionId) external payable nonReentrant {
+ // ... (other checks)
+ ++passSupply[collectionId];
+ _mint(msg.sender, collectionId, 1, "");
+ // ...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
26 days ago
inallhonesty Lead Judge 24 days ago
Submission Judgement Published
Validated
Assigned finding tags:

buyPass reentrancy to surpass the passMaxSupply

Appeal created

inallhonesty Lead Judge
24 days ago
inallhonesty Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

buyPass reentrancy to surpass the passMaxSupply

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.