Submission Details
Severity:
Lack of function to activate an inactive memorabilia collection
Root + Impact
Description
When the organizer creates a new memorabilia collection, they can set an is active flag, which makes the collection either redeemable or irredeemable.
function createMemorabiliaCollection(
string memory name,
string memory baseUri,
uint256 priceInBeat,
uint256 maxSupply,
@> bool activateNow
) external onlyOrganizer returns (uint256) {
.
.
.
collections[collectionId] = MemorabiliaCollection({
name: name,
baseUri: baseUri,
priceInBeat: priceInBeat,
maxSupply: maxSupply,
currentItemId: 1, // Start item IDs at 1
@> isActive: activateNow
});
emit CollectionCreated(collectionId, name, maxSupply);
return collectionId;
}
In case of setting the active flag to false and making the created collection irredeemable however, there's no function to change this flag and make the collection redeemable again, making the collection forever irredeemable for users.
Recommended Mitigation
Consider adding a function that allows the organizer to modify this flag.
Updates
Lead Judging Commences
inallhonesty about 2 months ago
Submission Judgement Published Assigned finding tags:
createMemorabiliaCollection with isActive false for later usage - flow not properly implemented.
Low because an organizer can use it with active = true and organizer is trusted.
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.