Beatland Festival

AI First Flight #4
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Submission Details
Impact: medium
Likelihood: medium
Invalid

Unbounded nested iteration in the getUserMemorabiliaDetailed() can render memorabilia queries unusable.

Root + Impact

As collections and editions grow, retrieval functions become increasingly expensive and may exceed RPC gas limits. Frontends can become unable to query user holdings.
getUserMemorabiliaDetailed() performs:
(https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L269)
https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L270
resulting in: O(collections × items) complexity.

Description

The function scans every collection and every minted edition regardless of whether the user owns any of them.
As the ecosystem grows, execution cost scales linearly with total protocol activity.
A sufficiently large number of collections can make the function practically unusable.
(https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L269)
https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L270
https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L271
https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L272
https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L273

Risk

Likelihood:

As collections and editions grows and become large this is surely to happen.

Impact:

Frontends can become unable to query user holdings.

Proof of Concept

Recommended Mitigation

Store user-owned memorabilia directly and update ownership during minting/transfers.
mapping(address => uint256[]) ownedMemorabilia; + add this code
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 5 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!