Root + Impact

The FestivalPass.sol constructor assigns the _beatToken parameter directly to storage without validating that it's a non-zero address.

Description

The constructor of FestivalPass accepts a _beatToken address parameter and stores it without verifying that it is not the zero address.

If _beatToken is set to address(0), any subsequent interaction that relies on:

will revert, as calls to the zero address are invalid.

Because constructor parameters are immutable after deployment, this misconfiguration permanently locks the contract into a non-functional state.

Risk

Likelihood:

• Deployment parameters are manually supplied.

• There is no validation preventing accidental misconfiguration.

• Constructor arguments are common sources of human error.

Impact:

• Any function that interacts with BeatToken(beatToken) will revert.

• Core functionality relying on the BEAT token becomes permanently unusable.

• The contract cannot be corrected post-deployment.

While no direct funds are immediately at risk, protocol functionality is effectively bricked.

Proof of Concept

1. Deploy FestivalPass with _beatToken = address(0)

2. Call any function that interacts with BeatToken(beatToken).

3. The call reverts because external calls to address(0) fail.

This demonstrates that the contract enters an unrecoverable misconfigured state.

Recommended Mitigation

Validate constructor input before assignment:

Adding this check prevents irreversible deployment misconfiguration.