Submission Details
Severity:
There is no way to change the status of `collection.isActive`
Root + Impact
Description
There is no way to change the status of
collection.isActive
// Create a new memorabilia collection
function createMemorabiliaCollection(
string memory name,
string memory baseUri,
uint256 priceInBeat,
uint256 maxSupply,
bool activateNow
) external onlyOrganizer returns (uint256) {
require(priceInBeat > 0, "Price must be greater than 0");
require(maxSupply > 0, "Supply must be at least 1");
require(bytes(name).length > 0, "Name required");
require(bytes(baseUri).length > 0, "URI required");
uint256 collectionId = nextCollectionId++;
collections[collectionId] = MemorabiliaCollection({
name: name,
baseUri: baseUri,
priceInBeat: priceInBeat,
maxSupply: maxSupply,
currentItemId: 1,
isActive: activateNow//@>Audit:no way to change
});
emit CollectionCreated(collectionId, name, maxSupply);
return collectionId;
}
Risk
Likelihood: Medium
Impact:Medium
If the setting is incorrect, it cannot be corrected.
Proof of Concept
function redeemMemorabilia(uint256 collectionId) external {
MemorabiliaCollection storage collection = collections[collectionId];
require(collection.priceInBeat > 0, "Collection does not exist");
require(collection.isActive, "Collection not active");//@> audit
require(collection.currentItemId < collection.maxSupply, "Collection sold out");
Recommended Mitigation
Add a function.
+ function setCollectionIsActive(uint256 collectionId,bool activateNow) public onlyOwner {
+ MemorabiliaCollection storage collection = collections[collectionId];
+ collection.isActive = activateNow;
+ }
Updates
Lead Judging Commences
inallhonesty about 2 months ago
Submission Judgement Published Assigned finding tags:
createMemorabiliaCollection with isActive false for later usage - flow not properly implemented.
Low because an organizer can use it with active = true and organizer is trusted.
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.