Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

[L-1] - Festival Contract Address Can Only Be Set Once

saremeskandary

Festival Contract Address Can Only Be Set Once + Flexibility/Upgrade Impact

Description

  • Normally, the setFestivalContract function allows the owner to set the address of the festival contract that controls minting and burning.

  • In this implementation, the address can only be set once. After the initial assignment, it cannot be changed, making the relationship between the token and the festival contract permanent.

function setFestivalContract(address _festival) external onlyOwner {
@> require(festivalContract == address(0), "Festival contract already set");
festivalContract = _festival;
}

Risk

Likelihood:

  • This will occur in any scenario where the festival contract needs to be upgraded or replaced after initial deployment.

  • Projects with long lifespans or evolving requirements are more likely to encounter this limitation.

Impact:

  • If the festival contract has a bug or needs new features, a new token contract must be deployed, disrupting users and integrations.

  • Loss of flexibility can increase operational and upgrade costs.

Proof of Concept

The following call demonstrates that after the initial assignment, any attempt to set the festival contract again will revert, making upgrades impossible:

// After initial set, this will always revert:
setFestivalContract(address(0x1234)); // "Festival contract already set"

Recommended Mitigation

Allowing the owner to update the festival contract address, possibly with a timelock, restores upgradeability while still providing security. The following change implements this flexibility:

- require(festivalContract == address(0), "Festival contract already set");
+ // Consider allowing owner to update, possibly with a timelock or multi-step process for safety
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

`setFestivalContract` only callable once

This is intended. It's done like that because the festival contract requires beat token's address and vice versa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.