Missing safety checks in the withdraw function present in line 146-149 of FestivalPass.sol
In the function withdraw(address target), missing safety checks before withdrawal of funds
"target" address check for validity is missing
Missing check for invalid/zero balance before withdrawal
Likelihood: HIGH
Reason 1: The function can be called with target = address(0)
, leading to ETH being irreversibly burned to the zero address — a scenario likely to occur during development, misconfigured frontend interactions, or mistakes in multisig calls.
Reason 2: The function allows withdrawals even when the contract balance is 0
, which will still consume gas and emit confusing or misleading off-chain signals about fund movement (e.g., on-chain monitoring tools or event triggers).
Impact: HIGH
Impact 1: Calling transfer(address(0))
results in a permanent loss of all ETH in the contract — this is economically damaging and can harm trust in the protocol.
Impact 2: Allowing withdrawals with a 0
balance may lead to unnecessary gas costs and create a false impression of successful payouts, confusing users or automated systems that track fund flows.
Vulnerability Summary
Location: FestivalPass.sol
, function withdraw(address target)
Lines:
Issue:
No validation that target
is a valid (non-zero) address.
No check for address(this).balance > 0
Type: Funds loss / Misconfigured execution / Missing precondition
PoC Structure (Foundry test)
Setup
Deploy a mock BeatToken
and FestivalPass
contract.
Fund the FestivalPass
contract with 10 ETH.
Set owner
and attacker
addresses for roles.
Business Impact
Silent ETH Loss: Without a check, a single mistake (passing address(0)) can permanently destroy all funds.
Wasted Gas + Monitoring Confusion: Triggering withdraw() on empty contracts can trip bots, analytics, or mislead users into thinking payouts were successful.
This mitigation does :
Adds zero address check before withdrawal of funds, ensures funds are not lost due to invalid address.
Adds zero balance check before withdrawal to prevent unnecessary gas cost
Owner/admin is trusted / Zero address check - Informational
Owner/admin is trusted / Zero address check - Informational
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.