Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

One-Time Lock on Festival Contract Prevents Upgrades or Recovery

gurmeetkalyan

Root + Impact

Description

  • In the setFestivalContract() function of the BeatToken contract, the festivalContract address can only be set once.

  • This non-upgradable hard lock restricts the project from making future upgrades or changes to the minter logic, even in emergencies.

function setFestivalContract(address _festival) external onlyOwner {
require(festivalContract == address(0), "Festival contract already set"); //@> One-time set makes system rigid
festivalContract = _festival;
}

Risk

Likelihood:

  • Happens when the deployed festivalContract needs to be updated due to a vulnerability or logic bug.

  • Happens if the festival address was incorrectly set initially.

Impact:

  • Reduces flexibility and upgradability of the contract ecosystem.

  • A misconfigured or deprecated festivalContract can permanently break minting functionality.

Proof of Concept

// After this call is made once:
token.setFestivalContract(0xAbc...);
​
// The following will always revert:
token.setFestivalContract(0xDEF...); // Reverts with "Festival contract already set"

Recommended Mitigation

- require(festivalContract == address(0), "Festival contract already set");
+ require(_festival != address(0), "Invalid address");
+ festivalContract = _festival;
​
+ // Add access control
+ function updateFestivalContract(address _festival) external onlyOwner {
+ require(_festival != address(0), "Invalid");
+ festivalContract = _festival;
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

`setFestivalContract` only callable once

This is intended. It's done like that because the festival contract requires beat token's address and vice versa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.