Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

External Call in `buyPass()` causes a Reentrancy Risk

0xmaxi

Root + Impact

Description

  • After minting the ERC‑1155 pass, the contract calls out to BeatToken.mint().

  • That external call could introduce a reentrancy path if BeatToken logic is extended.

if (bonus > 0) {
@>BeatToken(beatToken).mint(msg.sender, bonus);
}

Risk

Likelihood:

  • Future changes to the BEAT token (e.g., hooks, callbacks) add logic in mint().

  • Attackers implement malicious BEAT contract.

Impact:

  • Double‑minting passes or tokens for a single payment.

  • Loss of paid ETH or token supply inflation.

Proof of Concept

contract EvilBeat is BeatToken {
function mint(address to, uint256 amount) external override {
FestivalPass(fpAddress).buyPass(2); // reentrant
}
}

  • Replace BeatToken with a malicious contract that re-enters buyPass()

  • Call buyPass() and observe multiple passes or tokens being minted.

Recommended Mitigation

- function buyPass(uint256 collectionId) external payable {
+ function buyPass(uint256 collectionId) external payable nonReentrant {
…
}

  • Use Checks-Effects-Interactions pattern: update all state before external calls

  • Add a reentrancy guard modifier to the function

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 month ago
inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

buyPass reentrancy to surpass the passMaxSupply

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.