Root + Impact

Description

• Normally, when a new memorabilia collection is created using createMemorabiliaCollection, the collection can be activated immediately via the activateNow boolean. Once active, users can redeem memorabilia items using BEAT tokens.

• However, if the collection is created with activateNow = false, the collection is permanently inactive due to the absence of a function to later activate it. This results in a functional deadlock — the collection exists on-chain but cannot be used or interacted with meaningfully.

Risk

Likelihood:

• Organizers may choose to delay activation (for planning or sequencing) and call the function with activateNow = false.

• There is no mechanism to update the isActive flag afterward, which is not intuitive.

Impact:

• The collection becomes permanently inactive, leading to a non-functional or inaccessible NFT collection.

• This results in wasted storage, blocked token issuance, and may affect user or organizer trust if collections appear "broken".

Proof of Concept

Explanation: There is no available function to toggle isActive to true after creation, so any call to redeemMemorabilia() will fail indefinitely.

Recommended Mitigation

Add a simple function such as activateCollection() that allows the organizer to mark a previously created collection as active. This preserves flexibility without breaking the contract's existing logic. Optionally, a deactivateCollection() function can also be added for symmetric control.