Beatland Festival
AI First Flight #4
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: low
Valid

createMemorabiliaCollection() accepts activateNow = false with no activation mechanism, allowing an organizer to permanently lock user BEAT tokens by never activating a collection

virgilbb

Root + Impact

Description

  • createMemorabiliaCollection() accepts an activateNow parameter. When false, the collection is stored with isActive = false. redeemMemorabilia() requires collection.isActive, so users can never redeem BEAT for that collection.

  • No function exists to activate a collection after creation. Once created as inactive, a collection is permanently locked — users who accumulated BEAT expecting to redeem it have no recourse.

// src/FestivalPass.sol
function createMemorabiliaCollection(..., bool activateNow) external onlyOrganizer {
collections[collectionId] = MemorabiliaCollection({
// ...
isActive: activateNow // @> can be false forever — no activation path
});
}
​
function redeemMemorabilia(uint256 collectionId) external {
require(collection.isActive, "Collection not active"); // @> permanent block
}

Risk

Likelihood:

  • Organizers may create collections in advance for marketing purposes and never activate them. Even without malicious intent, the lack of an activation function makes this a protocol failure mode.

Impact:

  • Users hold BEAT tokens with reduced utility — the anticipated redemption target is unreachable. If high-value collections remain inactive, BEAT loses economic value and user trust.

Proof of Concept

An organizer creates an inactive collection. Alice buys a pass and earns BEAT. After an extended period, Alice still cannot redeem — the collection has no activation path.

function test_inactiveCollectionLocksBEAT() public {
vm.prank(alice);
festivalPass.buyPass{value: 0.1 ether}(VIP_PASS); // earns 5 BEAT welcome bonus
​
vm.prank(organizer);
uint256 collectionId = festivalPass.createMemorabiliaCollection(
"Limited Edition", "ipfs://limited", 3e18, 100, false // activateNow = false
);
​
vm.prank(alice);
vm.expectRevert("Collection not active");
festivalPass.redeemMemorabilia(collectionId);
​
vm.warp(block.timestamp + 365 days);
​
vm.prank(alice);
vm.expectRevert("Collection not active");
festivalPass.redeemMemorabilia(collectionId); // still blocked one year later
​
assertEq(beatToken.balanceOf(alice), 5e18); // BEAT held but unredeemable
}

Alice's BEAT is unredeemable indefinitely — confirming the missing activation path traps user funds in a useless state.

Recommended Mitigation

Add an organizer-callable activateCollection() function:

+ function activateCollection(uint256 collectionId) external onlyOrganizer {
+ require(collections[collectionId].priceInBeat > 0, "Collection does not exist");
+ collections[collectionId].isActive = true;
+ emit CollectionActivated(collectionId);
+ }
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[L-01] Inactive Collections — Indefinite BEAT Lock-up

# Inactive Collections — Indefinite BEAT Lock-up ## Description * Normal behaviour: Organizer creates memorabilia collections with `activateNow = true` so users can immediately redeem BEAT for NFTs. * Issue: Collections can be created with `activateNow = false` and there is **no mechanism** to activate them later, nor any timeout. Users may acquire BEAT expecting to redeem specific memorabilia, but the organizer can indefinitely prevent access. ```solidity function createMemorabiliaCollection(..., bool activateNow) external onlyOrganizer { // ... validation ... @> collections[collectionId] = MemorabiliaCollection({ // ... isActive: activateNow // Can be false forever }); } function redeemMemorabilia(uint256 collectionId) external { @> require(collection.isActive, "Collection not active"); // Permanent block // ... } ``` ## Risk **Likelihood**: * Organizer may create collections in advance but forget to activate. * Intentional strategy to create hype then indefinitely delay launch. **Impact**: * Users hold BEAT tokens anticipating memorabilia that never becomes available. * Economic utility of BEAT reduced if major collections remain locked. ## Proof of Concept ```solidity function test_CollectionNeverActivated() public { // Alice gets BEAT tokens vm.prank(alice); festivalPass.buyPass{value: 0.1 ether}(VIP_PASS); // gets 5 BEAT bonus // Organizer creates inactive collection vm.prank(organizer); uint256 collectionId = festivalPass.createMemorabiliaCollection( "Limited Edition", "ipfs://limited", 3e18, 100, false // NOT activated ); // Alice tries to redeem but can't vm.prank(alice); vm.expectRevert("Collection not active"); festivalPass.redeemMemorabilia(collectionId); // Time passes, organizer chooses not to activate vm.warp(block.timestamp + 365 days); // Alice still can't redeem - funds effectively locked vm.prank(alice); vm.expectRevert("Collection not active"); festivalPass.redeemMemorabilia(collectionId); assertEq(beatToken.balanceOf(alice), 5e18, "Alice holds 'useless' BEAT"); } ``` ## Recommended Mitigation ```diff + mapping(uint256 => bool) public collectionActivated; + function activateCollection(uint256 collectionId) external onlyOrganizer { + require(collections[collectionId].priceInBeat > 0, "Collection does not exist"); + collections[collectionId].isActive = true; + collectionActivated[collectionId] = true; + } // Or add automatic timeout: + uint256 constant ACTIVATION_DEADLINE = 30 days; + mapping(uint256 => uint256) public collectionCreatedAt; function createMemorabiliaCollection(...) external onlyOrganizer { // ... + collectionCreatedAt[collectionId] = block.timestamp; } function redeemMemorabilia(uint256 collectionId) external { MemorabiliaCollection storage collection = collections[collectionId]; + bool autoActive = block.timestamp >= collectionCreatedAt[collectionId] + ACTIVATION_DEADLINE; + require(collection.isActive || autoActive, "Collection not active"); // ... } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!