Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Resets Pass Supply (Bypass Cap)

cyber00t

Description

  • In normal behavior, each pass type has a limited supply tracked by passSupply[passId]. Once the supply reaches the maxSupply, no more passes should be mintable.

  • However, the configurePass() function resets passSupply[passId] = 0, which erases the count of how many passes were already sold. This allows an attacker (or malicious organizer) to reset the counter and sell more passes than originally allowed, bypassing the cap logic.


function configurePass(uint256 passId, uint256 price, uint256 maxSupply) external onlyOwner {
passPrice[passId] = price;
passMaxSupply[passId] = maxSupply;
passSupply[passId] = 0; // @> Supply counter is reset — original sold count is lost
}

Risk

Likelihood:

  • Occurs every time configurePass() is called with passSupply[passId] = 0

  • Especially likely if festival organizer reconfigures pricing or supply mid-lifecycle

Impact:

  • Organizer can bypass original mint cap for VIP/Backstage passes

  • Scarcity assumptions are broken; users may overpay for "limited" passes

  • Could lead to financial damage or trust issues for users and partners

Proof of Concept

// Original configuration
configurePass(2, 0.5 ether, 100); // VIP pass
// 100 users buy VIP passes
buyPass(2);
​
// Later...
configurePass(2, 0.5 ether, 200);
// Internally resets passSupply[2] = 0
​
// Result:
buyPass(2); // Will succeed again — even though 100 were already minted
​

Recommended Mitigation

- passSupply[passId] = 0;
+ require(maxSupply >= passSupply[passId], "Cannot reduce maxSupply below already sold amount");
+ passMaxSupply[passId] = maxSupply;
​

OR

- passSupply[passId] = 0;
+ // remove the reset entirely — track pass supply permanently
​
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

configurePass resets the current pass supply circumventing the max supply check

This is not acceptable as high because any attack vectors related to organizer trying to milk ETH from participants is voided by the fact that the organizer is trusted.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.