Beatland Festival

AI First Flight #4
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Submission Details
Impact: medium
Likelihood: medium
Invalid

Unbounded nested iteration in the getUserMemorabiliaDetailed() can render memorabilia queries unusable.

Root + Impact

As collections and editions grow, retrieval functions become increasingly expensive and may exceed RPC gas limits. Frontends can become unable to query user holdings.
getUserMemorabiliaDetailed() performs:
​
(https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L269)
https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L270
​
resulting in: O(collections × items) complexity.
​

Description

The function scans every collection and every minted edition regardless of whether the user owns any of them.
​
As the ecosystem grows, execution cost scales linearly with total protocol activity.
​
A sufficiently large number of collections can make the function practically unusable.
​
​
(https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L269)
https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L270
https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L271
https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L272
https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L273

Risk

Likelihood:

As collections and editions grows and become large this is surely to happen.

Impact:

Frontends can become unable to query user holdings.

Proof of Concept

​

Recommended Mitigation

Store user-owned memorabilia directly and update ownership during minting/transfers.
mapping(address => uint256[]) ownedMemorabilia; + add this code
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!