Submission Details
Impact:
Likelihood:
Missing Access Control in Interface Documentation
Description
Multiple functions like
buyPass(),redeemMemorabilia(),attendPerformance()are marked externally callable with no reference to access control modifiers (likeonlyOwner,onlyOrganizer, etc.).
Impact:
-
Unauthorized purchases or redemptions
-
Free BEAT token farming
-
Mint spam (DoS via NFT flooding)
Recommended Mitigation
Document expected modifiers in interface via comments, and enforce them strictly in the implementation.
Example:
/// @dev Only callable by organizer
function configurePass(...) external;
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.