Beatland Festival

Description

The protocol is designed to reward users with BEAT tokens for attending performances. However, the current implementation introduces two conditions that allow users to receive zero BEAT tokens despite valid participation:

1. General Pass holders receive no BEAT tokens upon pass purchase:

   uint256 bonus =

   (collectionId == VIP_PASS) ? 5e18 :

   (collectionId == BACKSTAGE_PASS) ? 15e18 :

   0;

2. The createPerformance() function allows reward = 0 without validation:

   function createPerformance(

   uint256 startTime,

   uint256 duration,

   uint256 reward

   ) external onlyOrganizer {

   require(startTime > block.timestamp);

   require(duration > 0);

   // reward may be 0

   }

3. BEAT tokens are minted solely based on the configured reward:

   BeatToken(beatToken).mint(

   msg.sender,

   performances[performanceId].baseReward * multiplier

   );

As a result, users—especially General Pass holders—can attend performances, pay gas, and still receive no BEAT tokens, despite the protocol being positioned as a reward-based system.

Impact

Primary Impact

• Users may attend performances without receiving BEAT tokens.

• Reward expectations are not consistently met.

Secondary Impact

• Reduced incentive for General Pass holders to participate.

• Confusion or dissatisfaction among users.

• Misalignment between documentation, UI expectations, and on-chain behavior.

Proof of Concept (PoC)

Scenario

1. Organizer configures a General Pass.

2. Organizer creates a performance with:

   reward = 0;

3. User purchases a General Pass (receives 0 BEAT bonus).

4. User attends the performance successfully.

5. attendPerformance() executes:

   baseReward * multiplier = 0 * 1 = 0

6. User receives 0 BEAT tokens.

Result

• User paid ETH and gas.

• User followed protocol rules.

• User received no BEAT reward.

Recommended Mitigation

Option A — Enforce Guaranteed Rewards (Strict Incentive Model)

Require all performances to distribute BEAT tokens:

Conclusion

The protocol’s current design allows valid participation without BEAT rewards due to unrestricted zero-reward performance creation and the absence of General Pass bonuses. While not a security vulnerability, this behavior introduces incentive inconsistency and may conflict with user expectations. Enforcing a minimum reward or explicitly documenting zero-reward scenarios will restore clarity and reliability to the protocol’s reward mechanism.