Submission Details
Severity:
`Soulmate::getDivorced` function is called it's not resetting the id's of the couples, which can impact the protocol's functionality, if future changes are made to the code implementation.
Summary
When a couple decides to divorce and Soulmate::getDivorced is called, it's not resetting the ownerToId mapping, which may cause future exploits, if any changes to the protocol are made related to it.
Vulnerability Details
Add the following in the SoulmateTest.t.sol file:
function testIdDoesNotReset() public {
// soulmate1, soulmate2 match-up, both have id = 0
_mintOneTokenForBothSoulmates();
address soulmate3 = makeAddr("soulmate3");
address soulmate4 = makeAddr("soulmate4");
// soulmate3, soulmate4 match-up, both have id = 1
vm.startPrank(soulmate3);
soulmateContract.mintSoulmateToken();
vm.stopPrank();
vm.startPrank(soulmate4);
soulmateContract.mintSoulmateToken();
vm.stopPrank();
// they divorce
vm.startPrank(soulmate3);
soulmateContract.getDivorced();
assert(soulmateContract.isDivorced());
vm.stopPrank();
vm.prank(soulmate4);
assert(soulmateContract.isDivorced());
// after divorce, all the couples still have the same id
assert(soulmateContract.ownerToId(soulmate1) == 0);
assert(soulmateContract.ownerToId(soulmate2) == 0);
assert(soulmateContract.ownerToId(soulmate3) == 1);
assert(soulmateContract.ownerToId(soulmate4) == 1);
}
Impact
Can lead to future vulnerabilities if changes are made to the code.
Tools Used
Manual Review, Foundry
Recommendations
Reset the ownerToId mapping for both owners, when getDivorced function is called:
function getDivorced() public {
address soulmate2 = soulmateOf[msg.sender];
divorced[msg.sender] = true;
divorced[soulmateOf[msg.sender]] = true;
+ ownerToId[msg.sender] = 0;
+ ownerToId[soulmateOf[msg.sender]] = 0;
emit CoupleHasDivorced(msg.sender, soulmate2);
}
Rewards breakdown
nSLOC
233This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.