Beatland Festival

Description:

The withdraw() function contains a comment stating "Organizer withdraws ETH" but implements the onlyOwner modifier, creating a mismatch between documented functionality and actual implementation. This inconsistency suggests either the access control is incorrectly implemented or the documentation is inaccurate. The discrepancy creates confusion about the intended business model where organizers are expected to manage festival operations including fund withdrawal, but the technical implementation restricts this capability to the contract owner only.

Attack path:

1. Pass sales generate ETH revenue that accumulates in the contract

2. Organizer attempts to withdraw collected funds using withdraw() function

3. Transaction reverts due to onlyOwner modifier, despite organizer believing they have legitimate access

4. Organizer cannot access festival revenue needed for operational expenses or profit distribution

Impact:

Organizers cannot access funds needed for festival operations, vendor payments, or profit distribution

Unclear delineation between owner and organizer roles undermines operational clarity

Recommended Mitigation:

Choose one of the following approaches to resolve the inconsistency:

1. Update documentation to match implementation:

1. Change modifier to match documentation:

1. Implement dual authorization for enhanced security while maintaining organizer control: