Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: low
Invalid

M04. Integer Overflow Risk in Performance Reward Calculation Causing Potential Denial of Service

accessdenied

Root + Impact

Description

  • The contract allows the organizer to set a baseReward for performances. When users attend, they receive rewards equal to baseReward * multiplier.

  • Solidity 0.8+ reverts automatically on arithmetic overflow. However, if the organizer sets a baseReward too large, multiplying it by the maximum multiplier (3) will cause an overflow revert when users attend the performance.

  • This means users cannot claim rewards for such performances, causing a denial of service in reward distribution.

// Root cause in the codebase with @> marks to highlight the relevant section
function attendPerformance(uint256 performanceId) external {
...
uint256 multiplier = getMultiplier(msg.sender);
//@> baseReward * multiplier can overflow and revert if baseReward is too large
BeatToken(beatToken).mint(msg.sender, performances[performanceId].baseReward * multiplier);
...
}

Risk

Likelihood:

  • The organizer might set an excessively large baseReward without considering the multiplier.

    • Users attending with passes that have a multiplier > 1 will trigger an overflow revert.

Impact:

  • Users cannot successfully call attendPerformance due to revert — denial of service for reward claiming.

  • Trust and user experience degrade because rewards cannot be claimed despite valid attendance.

Proof of Concept

If the organizer sets a very large baseReward close to the maximum uint256 value, multiplying it by the multiplier (up to 3) will cause an overflow, reverting transactions and preventing users from claiming rewards.

// Organizer sets a large reward near uint256 max / 3
uint256 bigReward = type(uint256).max / 3 + 1;
createPerformance(block.timestamp + 1 hours, 3600, bigReward); // Allowed
​
// User with BACKSTAGE_PASS (multiplier 3) attends
// reward calculation overflows and revert occurs
attendPerformance(performanceId); // Transaction reverts on overflow
​

Recommended Mitigation

+ uint256 constant MAX_MULTIPLIER = 3; // max multiplier from getMultiplier()
​
function createPerformance(
uint256 startTime,
uint256 duration,
uint256 reward
) external onlyOrganizer returns (uint256) {
require(startTime > block.timestamp, "Start time must be in the future");
require(duration > 0, "Duration must be greater than 0");
+ require(reward <= type(uint256).max / MAX_MULTIPLIER, "baseReward too high");
performances[performanceCount] = Performance({
startTime: startTime,
endTime: startTime + duration,
baseReward: reward
});
emit PerformanceCreated(performanceCount, startTime, startTime + duration);
return performanceCount++;
}
​

This prevents overflow reverts by enforcing a safe upper bound on the baseReward before creation. It improves user experience by guaranteeing reward calculations won’t revert due to overflow.

The second possibility is to set a maximum reward value

Updates

Lead Judging Commences

inallhonesty Lead Judge 26 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.