Submission Details
Impact:
Likelihood:
BEAT Welcome Bonus Can Be Repeated by Transferring/Burning Passes
Root + Impact
Description
Users can exploit the BEAT welcome bonus by repeatedly buying, transferring, or burning VIP/BACKSTAGE passes, and purchasing again to get new rewards.
if (bonus > 0) {
BeatToken(beatToken).mint(msg.sender, bonus); // @> No restriction on claiming bonus repeatedly
}
Risk
Likelihood:
Will occur when economically rational (BEAT has value)
Easy for users to automate
Impact:
BEAT supply can be inflated maliciously
Devalues rewards for legitimate users
Proof of Concept
festivalPass.buyPass{value: passPrice}(VIP_PASS);
festivalPass.safeTransferFrom(user, otherUser, VIP_PASS, 1, "");
// repeat buy for bonus again
Recommended Mitigation
+ require(!bonusClaimed[msg.sender][collectionId], "Bonus already claimed");
+ bonusClaimed[msg.sender][collectionId] = true;
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.