Root + Impact

Description

• The attendPerformance(uint256 performanceId) function allows a user to check into a performance and earn BEAT tokens. However, there is no enforced cooldown or usage tracking in interface, and no clear guidance for implementation to:

  • Prevent same user attending same performance multiple times

  • Prevent flashbots/mempool exploit to attend many times quickly

  Without protection, the user can spam attendPerformance() within the same block or across short time spans.

Risk

Likelihood:

• Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

• Reason 2

Impact:

• Infinite BEAT token minting

• BEAT token value collapse

• Game-theory imbalance among users

• Replay attacks using flashbots, sandwiching real users

Proof of Concept

Recommended Mitigation

In implementation:

✅ Track (user, performanceId) attendance in a mapping:

✅ Reject repeat calls:

✅ Optionally track and enforce minimum interval (lastAttendTimestamp)

• ✅ Add anti-bot verification (e.g., signature proof or off-chain gating)