Submission Details
Impact:
Likelihood:
Missing Performance Existence Check
Root + Impact
Description
No boundary checks for
collectionId/itemIdallow token ID collisions
Risk
Likelihood:
Only causes UX issues (no financial impact).
Impact:
Gas waste, false positives for non-existent performances.
Proof of Concept
function test_PhantomPerformance() public {
// Check non-existent performance #999
bool isActive = festivalPass.isPerformanceActive(999); // Returns false without error
// System treats it as valid inactive performance
assertTrue(!isActive); // But should revert
}
Recommended Mitigation
function isPerformanceActive(uint256 performanceId) public view returns (bool) {
+ require(performanceId < performanceCount, "Invalid ID");
// ... existing logic ...
}
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.