Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

[M-01] Configure pass multiple times for the same collection results in a reset of the supply

xgrybto

Root + Impact

Description

The function configurePass doesn't check if the collection has been already created. As a result, the supply is reset even though tokens have already been minted.

function configurePass(
uint256 passId,
uint256 price,
uint256 maxSupply
) external onlyOrganizer {
require(
passId == GENERAL_PASS ||
passId == VIP_PASS ||
passId == BACKSTAGE_PASS,
"Invalid pass ID"
);
require(price > 0, "Price must be greater than 0");
require(maxSupply > 0, "Max supply must be greater than 0");
​
passPrice[passId] = price;
passMaxSupply[passId] = maxSupply;
passSupply[passId] = 0; // Reset current supply
}

Risk

Likelihood:

  • the organizer make the mistake of configuring a pass that already exists

Impact:

  • reset the supply to 0

  • modify the parameter of the collection (max supply, price)

Proof of Concept

function test_configurePassTwoTimes() public {
vm.prank(user1);
festivalPass.buyPass{value: GENERAL_PRICE}(1);
assertEq(festivalPass.passSupply(1), 1);
vm.prank(organizer);
festivalPass.configurePass(1, GENERAL_PRICE, GENERAL_MAX_SUPPLY);
assertEq(festivalPass.passSupply(1), 0);
}

Recommended Mitigation

We need to verify that the collection id has not been used yet, so we need to monitor which collection has been created over time.

PS : Sorry for the explanation, that's a last minute submission :(

Updates

Lead Judging Commences

inallhonesty Lead Judge 25 days ago
Submission Judgement Published
Validated
Assigned finding tags:

configurePass resets the current pass supply circumventing the max supply check

This is not acceptable as high because any attack vectors related to organizer trying to milk ETH from participants is voided by the fact that the organizer is trusted.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.