Beatland Festival
AI First Flight #4
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

BeatToken.mint() and burnFrom() revert with misleading error when festivalContract is unset

cybervikink

Root + Impact

festivalContract defaults to address(0) with no guard checking for this explicitly. The check conflates "wrong caller" with "contract not configured".

Description

Both functions check:

require(msg.sender == festivalContract, "Only_Festival_Mint");

When festivalContract is address(0) (its default value before setFestivalContract is called), this check passes only if msg.sender == address(0) — impossible for any real caller. The error "Only_Festival_Mint" implies an authorisation failure, but the real cause is a missing deployment step. This delays debugging during integration or staging and can cause the entire reward system to silently fail if setFestivalContract is accidentally skipped.

Risk

Likelihood:

  • Likelihood: Low — deployment sequencing error

Impact:

  • Impact: Low — no exploit path; deployment misconfiguration causes silent failure with confusing error message

Proof of Concept

function test_misleadingErrorWhenUnset() public {
BeatToken bt = new BeatToken();
// setFestivalContract never called
vm.expectRevert("Only_Festival_Mint");
bt.mint(address(this), 1e18);
// Real cause: festivalContract == address(0), not an auth failure
}

Recommended Mitigation

function mint(address to, uint256 amount) external {
+ require(festivalContract != address(0), "Festival contract not configured");
require(msg.sender == festivalContract, "Only_Festival_Mint");
_mint(to, amount);
}
​
function burnFrom(address from, uint256 amount) external {
+ require(festivalContract != address(0), "Festival contract not configured");
require(msg.sender == festivalContract, "Only_Festival_Burn");
_burn(from, amount);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 8 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!