Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Unclear Supply Reset Behavior in configurePass() May Cause Unintended Overselling

lefeveje

Supply counter reset in configurePass() lacks clear documentation and may cause unintended consequences

Description

  • The configurePass() function unconditionally resets the supply counter to zero every time it's called, but this behavior is not clearly documented or obvious from the function name. An organizer making legitimate configuration changes (such as price adjustments) may not realize that the supply counter will be reset.

    While the code comment indicates this may be intentional behavior ("Reset current supply"), the function name configurePass() suggests general configuration rather than specifically indicating a supply reset. This could lead to confusion about the function's full effects.

function configurePass(
uint256 passId,
uint256 price,
uint256 maxSupply
) external onlyOrganizer {
require(passId == GENERAL_PASS || passId == VIP_PASS || passId == BACKSTAGE_PASS, "Invalid pass ID");
require(price > 0, "Price must be greater than 0");
require(maxSupply > 0, "Max supply must be greater than 0");
​
passPrice[passId] = price;
passMaxSupply[passId] = maxSupply;
// @> Unclear behavior: Always resets supply regardless of intent
passSupply[passId] = 0; // Reset current supply
}

Risk

Likelihood:

  • Organizer calls the function multiple times for legitimate configuration updates

  • Function name does not clearly indicate supply reset behavior

  • No explicit warnings or documentation about the reset behavior

Impact:

  • Organizer may be surprised by supply counter reset when intending only to change price

  • Could lead to more passes being available than originally planned

  • Potential confusion in pass management and tracking

Proof of Concept

// Organizer sets up passes
configurePass(VIP_PASS, 1 ether, 100);
​
// Users buy 50 VIP passes
// passSupply[VIP_PASS] = 50
​
// Organizer wants to increase price due to demand
configurePass(VIP_PASS, 1.5 ether, 100);
// passSupply[VIP_PASS] = 0 (reset, potentially unexpected)
​
// Now 100 more passes can be sold instead of remaining 50

Recommended Mitigation

//Add clearer documentation or separate the concerns:
​
// Option 1: More explicit function naming
function resetAndConfigurePass(uint256 passId, uint256 price, uint256 maxSupply) external onlyOrganizer {
// Current behavior with clearer name
}
​
// Option 2: Separate functions
function updatePassPrice(uint256 passId, uint256 price) external onlyOrganizer {
require(passMaxSupply[passId] > 0, "Pass not configured");
passPrice[passId] = price;
// No supply reset
}
​
function resetPassSupply(uint256 passId) external onlyOrganizer {
passSupply[passId] = 0;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

configurePass resets the current pass supply circumventing the max supply check

This is not acceptable as high because any attack vectors related to organizer trying to milk ETH from participants is voided by the fact that the organizer is trusted.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.