Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

No Explicit Checks for Reentrancy in FestivalPass

ishwar

Description + Impact

  • The FestivalPass contract manages pass sales, memorabilia redemption, and ETH withdrawal. Normal behavior expects state updates before any external calls to prevent reentrancy.

  • The contract does not use explicit reentrancy guards (such as OpenZeppelin's ReentrancyGuard). This omission leaves the contract at risk for future reentrancy vulnerabilities if code changes introduce external calls before state updates.

function buyPass(uint256 collectionId) external payable {
_mint(msg.sender, collectionId, 1, "");
++passSupply[collectionId];
uint256 bonus = (collectionId == VIP_PASS) ? 5e18 : (collectionId == BACKSTAGE_PASS) ? 15e18 : 0;
if (bonus > 0) {
BeatToken(beatToken).mint(msg.sender, bonus); //@>
}
emit PassPurchased(msg.sender, collectionId);
}

Risk

Likelihood:

  • Future development or contract upgrades can introduce external calls before critical state changes.

  • Integrating with third-party contracts or new code paths increases reentrancy exposure.

Impact:

  • Attacker can exploit vulnerable functions to double-mint tokens/NFTs or drain ETH.

  • Loss of funds, broken business logic, and contract insolvency.

Proof of Concept

// Example future vulnerability if state assignment order changes
function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance); //@> external call before state update
// Target contract fallback re-enters withdraw(), draining funds repeatedly
}

Recommended Mitigation

- function buyPass(uint256 collectionId) external payable {
+ function buyPass(uint256 collectionId) external payable nonReentrant {

  • Use OpenZeppelin's ReentrancyGuard and apply nonReentrant modifier to all external functions that transfer assets or change critical state.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Too generic

Appeal created

ishwar Submitter
about 2 months ago
inallhonesty Lead Judge
about 2 months ago
ishwar Submitter
about 1 month ago
inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Too generic

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.