Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

ID Collision between Pass and Memorabilia Enables Unauthorized Access

georgibuilds

Root + Impact

Description

  • The contract encodes ERC1155 token IDs as:ces

tokenId = (collectionId << 128) + itemId

If a memorabilia collection is created with collectionId = 0, its first item will have tokenId = 1, which collides with the General Pass tokenId (1).
A user who owns only the first memorabilia from collection 0 will appear to own a General Pass, bypassing all access control, rewards, and event gates.
This can be used to get unauthorized privileges or even claim rewards/events without paying for a pass

Risk

Likelihood:

  • This will occur whenever a memorabilia collection is created with collectionId = 0 (default in many counter-based implementations)

  • No special permission is required, just being the first to redeem from the first memorabilia collection

Impact:

  • Unauthorized access to premium features, events, or rewards

  • Financial and reputation risk to the protocol

  • Potential for large-scale abuse if not fixed

Proof of Concept

// 1. Organizer creates memorabilia collection; gets collectionId = 0
vm.prank(organizer);
uint256 collectionId = festivalPass.createMemorabiliaCollection(
"Collision Collection",
"ipfs://collision",
1e18,
5,
true
);
​
// 2. User redeems the first memorabilia item, gets tokenId = 1
vm.prank(address(festivalPass));
beatToken.mint(user1, 10e18);
​
vm.prank(user1);
festivalPass.redeemMemorabilia(collectionId);
​
// 3. Check: user1 hasPass() returns true (even without real pass)
bool hasGeneralPass = festivalPass.hasPass(user1);
assertTrue(hasGeneralPass, "User appears to have General Pass due to ID collision!");
​

Recommended Mitigation

- Allow memorabilia collections to be created with collectionId = 0
+ Always initialize memorabilia collectionId to start at 1 (never 0)
+ Add a require statement in createMemorabiliaCollection: require(nextCollectionId > 0)
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.