Beatland Festival

AI First Flight #4

Beginner FriendlyFoundrySolidityNFT

EXP

View results

Previous Next

Submission Details

Severity: medium

Valid

Pass reconfiguration resets supply tracking allowing unlimited minting (SUPPLY TRACKING BYPASS + UNLIMITED PASS MINTING)

comfortnurse021

The configurePass function is designed to allow organizers to set pass pricing and maximum supply limits, with passSupply tracking the current number of minted passes to enforce these limits.
The function incorrectly resets passSupply[passId] = 0 on every call, breaking supply tracking and allowing unlimited pass purchases after any reconfiguration, completely bypassing the maximum supply protection mechanism.
https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/src/FestivalPass.sol#L54-65

function configurePass(

uint256 passId,

uint256 price,

uint256 maxSupply

) external onlyOrganizer {

require(passId == GENERAL_PASS || passId == VIP_PASS || passId == BACKSTAGE_PASS, "Invalid pass ID");

require(price > 0, "Price must be greater than 0");

require(maxSupply > 0, "Max supply must be greater than 0");

passPrice[passId] = price;

passMaxSupply[passId] = maxSupply;

@> passSupply[passId] = 0; // Reset current supply

}

Risk

Likelihood:

Organizers will reconfigure passes during normal operations to adjust pricing or increase supply limits for popular events
The vulnerability triggers immediately when any pass configuration is updated after initial sales begin

Impact:

Complete bypass of maximum supply limits allowing unlimited pass minting
Economic model collapse as actual pass circulation exceeds intended limits by potentially thousands of passes
Financial losses to the protocol as passes intended to be scarce become unlimited

Proof of Concept

// SPDX-License-Identifier: MIT

pragma solidity 0.8.25;

import {Test, console} from "forge-std/Test.sol";

import {FestivalPass} from "../src/FestivalPass.sol";

import {BeatToken} from "../src/BeatToken.sol";

contract PassReconfigurationExploitTest is Test {

FestivalPass public festivalPass;

BeatToken public beatToken;

address public owner;

address public organizer;

address public attacker;

uint256 constant GENERAL_PRICE = 0.05 ether;

uint256 constant VIP_PRICE = 0.1 ether;

uint256 constant BACKSTAGE_PRICE = 0.25 ether;

uint256 constant GENERAL_MAX_SUPPLY = 100;

uint256 constant VIP_MAX_SUPPLY = 50;

uint256 constant BACKSTAGE_MAX_SUPPLY = 10;

function setUp() public {

owner = address(this);

organizer = makeAddr("organizer");

attacker = makeAddr("attacker");

// Deploy contracts

beatToken = new BeatToken();

festivalPass = new FestivalPass(address(beatToken), organizer);

// Set festival contract in BeatToken

beatToken.setFestivalContract(address(festivalPass));

// Configure passes as organizer

vm.startPrank(organizer);

festivalPass.configurePass(1, GENERAL_PRICE, GENERAL_MAX_SUPPLY);

festivalPass.configurePass(2, VIP_PRICE, VIP_MAX_SUPPLY);

festivalPass.configurePass(3, BACKSTAGE_PRICE, BACKSTAGE_MAX_SUPPLY);

vm.stopPrank();

// Fund attacker

vm.deal(attacker, 10 ether);

}

function test_PassReconfigurationExploit() public {

// Fill pass supply to maximum

for (uint i = 0; i < GENERAL_MAX_SUPPLY; i++) {

address user = makeAddr(string(abi.encodePacked("user", i)));

vm.deal(user, 1 ether);

vm.prank(user);

festivalPass.buyPass{value: GENERAL_PRICE}(1);

}

assertEq(festivalPass.passSupply(1), GENERAL_MAX_SUPPLY);

// Verify max supply reached

vm.prank(attacker);

vm.expectRevert("Max supply reached");

festivalPass.buyPass{value: GENERAL_PRICE}(1);

// Organizer reconfigures pass - vulnerability triggers

vm.prank(organizer);

festivalPass.configurePass(1, GENERAL_PRICE, 200);

// Supply reset to 0 - exploit now possible

assertEq(festivalPass.passSupply(1), 0);

// Attacker can now buy unlimited passes

vm.prank(attacker);

festivalPass.buyPass{value: GENERAL_PRICE}(1);

assertEq(festivalPass.balanceOf(attacker, 1), 1);

assertEq(festivalPass.passSupply(1), 1); // Should be 101

}

Recommended Mitigation

passPrice[passId] = price;

passMaxSupply[passId] = maxSupply;

- passSupply[passId] = 0; // Reset current supply

}

function configurePass(uint256 passId, uint256 price, uint256 maxSupply) external onlyOrganizer {

require(passId == GENERAL_PASS || passId == VIP_PASS || passId == BACKSTAGE_PASS, "Invalid pass ID");

require(price > 0, "Price must be greater than 0");

require(maxSupply > 0, "Max supply must be greater than 0");

+ require(passSupply[passId] == 0, "Cannot reconfigure after passes minted");

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago

Submission Judgement Published

Validated

Assigned finding tags:

[M-01] [H-1] Reseting the current pass supply to 0 in the FestivalPass::configurePass function allows users to bypass the max supply cap of a pass

# \[H-1] Reseting the current pass supply to `0` in the `FestivalPass::configurePass` function allows users to bypass the max supply cap of a pass ## Description: ```solidity function configurePass(uint256 passId, uint256 price, uint256 maxSupply) external onlyOrganizer { require(passId == GENERAL_PASS || passId == VIP_PASS || passId == BACKSTAGE_PASS, "Invalid pass ID"); require(price > 0, "Price must be greater than 0"); require(maxSupply > 0, "Max supply must be greater than 0"); passPrice[passId] = price; passMaxSupply[passId] = maxSupply; @> passSupply[passId] = 0; // Reset current supply } ``` If you reset `passSupply[passId]` to `0` in the `FestivalPass::configurePass` function after passes have been sold, the next buyer will be able to mint as if no passes have been sold. This allows the total minted passes to exceed `passMaxSupply`, which is a serious vulnerability (a supply cap bypass) ## Impact: * Supply caps become meaningless: The users can mint unlimited passes beyond the intended maximum supply * Pass scarcity and value are destroyed, affecting the economic model ## Proof of Concept: ```solidity function test_SupplyCapBypassVulnerability() public { // Step 1: Configure a pass with max supply of 2 vm.prank(organizer); festivalPass.configurePass(1, GENERAL_PRICE, 2); // Step 2: Buy 2 passes (reaching max supply) vm.prank(user1); festivalPass.buyPass{value: GENERAL_PRICE}(1); vm.prank(user2); festivalPass.buyPass{value: GENERAL_PRICE}(1); // Verify max supply reached assertEq(festivalPass.passSupply(1), 2); assertEq(festivalPass.passMaxSupply(1), 2); // Step 3: Try to buy another pass - should fail address user3 = makeAddr("user3"); vm.deal(user3, 10 ether); vm.prank(user3); vm.expectRevert("Max supply reached"); festivalPass.buyPass{value: GENERAL_PRICE}(1); // Step 4: VULNERABILITY - Organizer reconfigures the pass // This resets passSupply[1] to 0, bypassing the supply cap! vm.prank(organizer); festivalPass.configurePass(1, GENERAL_PRICE, 2); // Step 5: Now we can buy more passes even though max supply was already reached vm.prank(user3); festivalPass.buyPass{value: GENERAL_PRICE}(1); // Step 6: We can even buy more passes beyond the original max supply vm.deal(user4, 10 ether); vm.prank(user4); festivalPass.buyPass{value: GENERAL_PRICE}(1); // Step 7: Verify the vulnerability - total supply exceeds max supply assertEq(festivalPass.passSupply(1), 2); // Current supply counter assertEq(festivalPass.passMaxSupply(1), 2); // Max supply limit // But we actually have 4 passes minted in total! assertEq(festivalPass.balanceOf(user1, 1), 1); assertEq(festivalPass.balanceOf(user2, 1), 1); assertEq(festivalPass.balanceOf(user3, 1), 1); assertEq(festivalPass.balanceOf(user4, 1), 1); // Total minted: 4 passes, but max supply is only 2! uint256 totalMinted = festivalPass.balanceOf(user1, 1) + festivalPass.balanceOf(user2, 1) + festivalPass.balanceOf(user3, 1) + festivalPass.balanceOf(user4, 1); assertGt(totalMinted, festivalPass.passMaxSupply(1), "VULNERABILITY: Total minted exceeds max supply!"); } ``` ## Recommended Mitigation: The `passSupply` reset should be removed ```diff function configurePass(uint256 passId, uint256 price, uint256 maxSupply) external onlyOrganizer { require(passId == GENERAL_PASS || passId == VIP_PASS || passId == BACKSTAGE_PASS, "Invalid pass ID"); require(price > 0, "Price must be greater than 0"); require(maxSupply > 0, "Max supply must be greater than 0"); passPrice[passId] = price; passMaxSupply[passId] = maxSupply; - passSupply[passId] = 0; } ```

Rewards breakdown

This contest has a flat reward structure with the following payouts:

Live

The contest is live. Earn rewards by submitting a finding.

Judging

Submissions are being reviewed by our AI judge. Results will be available in a few minutes.

View all submissions

Rewards Distribution

The contest is complete and the rewards are being distributed.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!