Submission Details
Impact:
Likelihood:
Irrecoverable Festival Contract Address; Permanent Loss of Mint/Burn Functionality
# [H-2] Irrecoverable Festival Contract Address; Permanent Loss of Mint/Burn Functionality
## Description
- Normally, the owner should be able to set or update the festival contract address to enable minting and burning of BEAT tokens.
- The current implementation allows `setFestivalContract` to be called only **once**, and if the owner mistakenly sets it to the **zero address**, the mint and burn functions become permanently inaccessible.
```javascript
function setFestivalContract(address _festival) external onlyOwner {
require(festivalContract == address(0), "Festival contract already set"); // @audit cannot be reused for other festivals
festivalContract = _festival;
}
```
## Risk
### Likelihood:
This will occur when the owner accidentally sets the festival contract to the zero address or an incorrect address.
The function **cannot** be called again to fix the mistake.
### Impact:
* Minting and burning of BEAT tokens is **permanently disabled**.
* The token contract becomes **unusable** for its intended festival functionality.
## Proof of Concept
```javascript
// Owner calls:
setFestivalContract(address(0));
// After this call, any call to mint or burnFrom will always revert,
// and the festival contract cannot be set again.
```
## Recommended Mitigation
Allow the owner to update the festival contract address, but **prevent setting it to the zero address**.
### Option 1: One-time Set with Zero Address Check
```diff
- require(festivalContract == address(0), "Festival contract already set");
- festivalContract = _festival;
+ require(_festival != address(0), "Invalid festival contract");
+ festivalContract = _festival;
```
### Option 2: Allow Updating the Festival Contract Multiple Times
```diff
- require(festivalContract == address(0), "Festival contract already set");
+ require(_festival != address(0), "Invalid festival contract");
+ festivalContract = _festival;
```
---
Updates
Lead Judging Commences
inallhonesty about 2 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Zero address check
Owner/admin is trusted / Zero address check - Informational
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.