Submission Details
Impact:
Likelihood:
[L-3] Performance Management Issue in `FestivalPass::createPerformance` Missing Maximum Duration Validation
Description
The `createPerformance` function allows an organizer to create a performance by specifying a startTime, duration, and reward.
While it correctly checks that:
startTime is in the future, duration > 0, it does not enforce any maximum duration constraint:
```javascript
require(duration > 0, "Duration must be greater than 0");
// NO upper bound on duration
```
This allows a performance to last for years, decades, or even forever (uint256.max),
which may not be desired or intended behavior.
Risk
Impact:
A malicious or careless organizer could:
1. Create a performance that never ends.
2. Block users from checking in to other events due to the cooldown system.
3. Cause UI and analytics systems to misrepresent the schedule (e.g., events still appearing active years later).
Proof of Concept
```javascript
// Set start time to now + 1 hour
uint256 start = block.timestamp + 3600;
// Set duration to 100 years
uint256 duration = 100 * 365 days;
festivalPass.createPerformance(start, duration, 10e18);
```
This creates a performance that lasts 100 years, which would always be "active" once started unless other guards are present.
Recommended Mitigation
```diff
function createPerformance(
uint256 startTime,
uint256 duration,
uint256 reward
) external onlyOrganizer returns (uint256) {
require(startTime > block.timestamp, "Start time must be in the future");
- require(duration > 0, "Duration must be greater than 0");
+ require(duration > 0 && duration <= 30 days, "Duration must be between 1 and 30 days");
// Set start/end times
performances[performanceCount] = Performance({
// rest of code
```
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.