Submission Details
Impact:
Likelihood:
Missing Check for burnFrom() Authorization in redeemMemorabilia
Root + Impact
Description
The redeemMemorabilia function calls
BeatToken(beatToken).burnFrom(msg.sender, collection.priceInBeat);
Risk
Likelihood:
Reason 1: If the BEAT token doesn't properly restrict
burnFrom()(e.g., usingmsg.senderonly), then any address can potentially trigger a burn from another user's balance.
Impact:
-
Impact 1: Unauthorized token burning, leading to DoS or stolen value.
Proof of Concept
festival.redeemMemorabilia(collectionId); // No approval required
// If BeatToken doesn't enforce proper msg.sender == festivalContract, tokens can be burned freely.
Recommended Mitigation
Ensure burnFrom() in BeatToken strictly checks:
Or add approval mechanism before burn.
require(msg.sender == expectedContract); // or via allowances
Updates
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.