Submission Details
Impact:
Likelihood:
No Way to Cancel or Modify Performances After Creation
Root + Impact
Description
-
Once a performance is created, there is no mechanism to cancel, modify, or deactivate it. If a performance is misconfigured (wrong time, wrong reward, etc.), it cannot be corrected, potentially leading to unintended economic consequences.
Risk
Likelihood:
-
* Performances are created by organizer who may make mistakes
* No way to fix errors after creation
* Performances cannot be cancelled for emergency situations
Impact:
-
* Cannot fix misconfigured performances
* No emergency controls
* Potential economic losses from incorrect configurations
Proof of Concept
```diff
+mapping(uint256 => bool) public performanceCancelled;
function cancelPerformance(uint256 performanceId) external onlyOrganizer {
+ require(performances[performanceId].startTime != 0, "Performance does not exist");
+ require(!isPerformanceActive(performanceId), "Cannot cancel active performance");
+ performanceCancelled[performanceId] = true;
+ emit PerformanceCancelled(performanceId);
}
function isPerformanceActive(uint256 performanceId) public view returns (bool) {
Performance memory perf = performances[performanceId];
+ if (performanceCancelled[performanceId]) return false;
return perf.startTime != 0 &&
block.timestamp >= perf.startTime &&
block.timestamp <= perf.endTime;
}
```
Recommended Mitigation
```diff
+mapping(uint256 => bool) public performanceCancelled;
function cancelPerformance(uint256 performanceId) external onlyOrganizer {
+ require(performances[performanceId].startTime != 0, "Performance does not exist");
+ require(!isPerformanceActive(performanceId), "Cannot cancel active performance");
+ performanceCancelled[performanceId] = true;
+ emit PerformanceCancelled(performanceId);
}
function isPerformanceActive(uint256 performanceId) public view returns (bool) {
Performance memory perf = performances[performanceId];
+ if (performanceCancelled[performanceId]) return false;
return perf.startTime != 0 &&
block.timestamp >= perf.startTime &&
block.timestamp <= perf.endTime;
}
```
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.