Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

No Access Restriction for BEAT Welcome Bonus

cyber00t

Description

  • Normally, VIP and BACKSTAGE pass holders receive a one-time BEAT token welcome bonus upon purchase.

  • However, the buyPass() function does not prevent users from calling it repeatedly to claim the welcome bonus multiple times using the same address.

function buyPass(uint256 passId) external payable {
...
if (passId == 2) {
beatToken.mint(msg.sender, 100 ether);
} else if (passId == 3) {
beatToken.mint(msg.sender, 200 ether);
}
// @> No tracking of bonus claim per user => Users can repeatedly buy and resell
}
​

Risk

Likelihood:

  • Users can buy and immediately resell or transfer passes to a new address, then re-purchase for repeated bonuses.

  • This occurs in a non-custodial flow, as passes are just ERC1155 tokens — no check ensures "first-time" ownership or one-time bonus claim.

Impact:

  • Users can flood the system with BEAT tokens by looping purchases, inflating token supply.

  • Reward system is broken — intended one-time welcome bonuses become an infinite faucet.

  • Disrupts BEAT-based utility and undermines game theory of participation.

Proof of Concept

// User calls buyPass(3) multiple times:
festivalPass.buyPass{value: 0.5 ether}(3);
// Mints 200 BEAT
​
// Transfer pass to burner, repeat:
festivalPass.safeTransferFrom(attacker, burner, 3, 1, "");
festivalPass.buyPass{value: 0.5 ether}(3);
// Mints another 200 BEAT
​

Recommended Mitigation

+ mapping(address => bool) public welcomeBonusClaimed;
...
function buyPass(uint256 passId) external payable {
+ require(!welcomeBonusClaimed[msg.sender], "Already claimed welcome bonus");
​
...
if (passId == 2) {
beatToken.mint(msg.sender, 100 ether);
} else if (passId == 3) {
beatToken.mint(msg.sender, 200 ether);
}
​
+ welcomeBonusClaimed[msg.sender] = true;
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.