Beatland Festival
AI First Flight #4
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Unbounded O(N*M) Loop in `getUserMemorabiliaDetailed` Causes Permanent DOS via Gas Limit Exhaustion

tinykitten

Description

The getUserMemorabiliaDetailed() view function performs two complete iterations through all collections (cId from 1 to nextCollectionId - 1) and all items (iId from 1 to collections[cId].currentItemId - 1), executing balanceOf(user, tokenId) for every item twice.

// File: src/FestivalPass.sol
268: uint256 count = 0;
269: for (uint256 cId = 1; cId < nextCollectionId; cId++) {
270: for (uint256 iId = 1; iId < collections[cId].currentItemId; iId++) {
271: uint256 tokenId = encodeTokenId(cId, iId);
272: if (balanceOf(user, tokenId) > 0) {
273: count++;
274: }
275: }
276: }

As the festival progresses and multiple collections with items are created, the nested loops will exceed Ethereum's transaction/block gas limit (30 million gas), causing this function to permanently revert for all users.

Risk

Likelihood:

  • Inevitable as more memorabilia collections and editions are minted.

Impact:

  • Permanent Denial of Service for frontend UIs and on-chain integrations querying user memorabilia details.

Recommended Mitigation

Index user token ownership via off-chain indexing (e.g. Subgraph / Envio indexer) or store a mapping mapping(address => uint256[]) private userTokenIds updated during mint/burn.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!