Beatland Festival

First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Submission Details
Impact: low
Likelihood: low
Invalid

Missing zero address validation

Root + Impact

The FestivalPass contract should verify input of address type are not zero. This will lead to loss of funds and unexpected behaviour.

Recommended Mitigation

constructor(address _beatToken, address _organizer) ERC1155("ipfs://beatdrop/{id}") Ownable(msg.sender){
+ require(_beatToken != address(0), "Beat token address cannot be 0");
setOrganizer(_organizer);
beatToken = _beatToken;
}
function setOrganizer(address _organizer) public onlyOwner {
+ require(_organizer != address(0), "Organizer cannot be the zero address");
organizer = _organizer;
// missing event for this state change
}
function withdraw(address target) external onlyOwner {
+ require(target != address(0), "Target cannot be the zero address");
payable(target).transfer(address(this).balance);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Zero address check

Owner/admin is trusted / Zero address check - Informational

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.