Beatland Festival
AI First Flight #4
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: low
Invalid

Missing Zero-Address validation in constructor

raihanmd

Missing Zero-Address validation in constructor

Description

The system configuration parameters inside the FestivalPass constructor directly assign state tracking references without enforcing defensive validation boundaries against zero-address allocations (address(0)):

constructor(address _beatToken, address _organizer) ERC1155("ipfs://beatdrop/{id}") Ownable(msg.sender) {
// ! low no 0 adddr check
setOrganizer(_organizer);
@> beatToken = _beatToken;
}
​
function setOrganizer(address _organizer) public onlyOwner {
@> organizer = _organizer;
}

If internal configurations or human deployment slip-ups pass invalid parameter references, critical addresses will be permanently set to address(0).

Risk

Impact High

  • Impaired System Control: Failing to define the core token standard address correctly will break tokenomics configurations such as calling BeatToken(beatToken).mint() or burnFrom(), leading to systemic runtime failures.

  • Operational Friction: If organizer resolves as a zero address, access-controlled methods dependent on the onlyOrganizer modifier will remain locked out until manually reconfigured via setOrganizer by the contract owner.

Likelyhood Low

  • All the action must be done by owner of the contract

Recommended Mitigation

Introduce standard sanity constraints via require statements or custom errors targeting contract configuration variables within the initialization flow:

+ error ZeroAddressDetected();
​
constructor(address _beatToken, address _organizer) ERC1155("ipfs://beatdrop/{id}") Ownable(msg.sender) {
+ if (_beatToken == address(0) || _organizer == address(0)) revert ZeroAddressDetected();
setOrganizer(_organizer);
beatToken = _beatToken;
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 4 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!