Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

Missing Zero Address Validation in Constructor

cyber00t

Root + Impact

Description

The constructor of the FestivalPass contract takes two critical address inputs during deployment:

  • _beatToken: The address of the deployed BeatToken ERC20 contract.

  • _organizer: The address assigned organizer privileges in the contract.

However, there is no input validation to ensure that either of these is a non-zero address. If a deployer accidentally passes address(0) for either:

  • beatToken will be set to 0x0000000000000000000000000000000000000000, making all interactions with BEAT tokens (minting, burning, etc.) revert.

  • organizer will be set to the zero address, effectively disabling all organizer-only actions, such as configuring passes, creating performances, or redeeming memorabilia.

Since these roles are core to the platform’s functionality, their misconfiguration can lead to permanent breakage.

This is a deployment-time misconfiguration risk, and once deployed with address(0), it cannot be fixed.

constructor(address _beatToken, address _organizer) ERC1155("ipfs://beatdrop/{id}") Ownable(msg.sender)
{
​
@> setOrganizer(\_organizer);
​
@> beatToken = \_beatToken;
​
}
​

No require(_beatToken != address(0))

No require(_organizer != address(0))

Risk

Likelihood:

  • This will occur when a developer or deployment script mistakenly passes address(0) for either parameter (e.g., missing env var or wrong config).

  • No fallback or sanity check exists to detect or reject this invalid input.

Impact:

  • If organizer is zero, every organizer-only function becomes unusable (e.g., createPerformance, configurePass, withdraw, etc.).

  • If beatToken is zero, functions like buyPass, attendPerformance, and redeemMemorabilia that interact with the BEAT token will revert or silently fail, breaking core festival logic.

Proof of Concept

// Misconfigured deployment
FestivalPass fest = new FestivalPass(address(0), address(0));
​
// Consequences:
fest.createPerformance(123, 60, 10);
// => reverts: "Only organizer can call this"
​
fest.buyPass(1);
// => fails during BeatToken(0x0).mint(...) call
​

Recommended Mitigation

constructor(address _beatToken, address _organizer)
ERC1155("ipfs://beatdrop/{id}")
Ownable(msg.sender)
{
+ require(_beatToken != address(0), "Invalid BeatToken address");
+ require(_organizer != address(0), "Invalid organizer address");
​
setOrganizer(_organizer);
beatToken = _beatToken;
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 26 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Zero address check

Owner/admin is trusted / Zero address check - Informational

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.