First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Anyone can write to Soulmate shared space

kiqo

Summary

Anyone can write in the shared space by calling Soulmate::writeMessageInSharedSpace.

Vulnerability Details

To write in the shared space the function writeMessageInSharedSpacechecks the id of the soul token owned by the caller by uint256 id = ownerToId[msg.sender];, for a user that doesn't have a soulmate token, this will result in id = 0 and therefore will be allowed to write a message in the space of the owners of token id 0.

POC

Copy the following test into SoulmateTest.t.sol and run forge test --mt test_write_in_shares_space_0

function test_write_in_shares_space_0() public {
address random_writter = makeAddr("random_writter");
vm.prank(random_writter);
soulmateContract.writeMessageInSharedSpace("Buy some eggs!");
​
// anyone can view messages in blockchain
string memory message = soulmateContract.readMessageInSharedSpace();
string[4] memory possibleText = [
"Buy some eggs!, sweetheart",
"Buy some eggs!, darling",
"Buy some eggs!, my dear",
"Buy some eggs!, honey"
];
bool found;
for (uint256 i; i < possibleText.length; i++) {
if (compare(possibleText[i], message)) {
found = true;
break;
}
}
assertTrue(found);
}

Impact

Any user will be able to write a message in the space of the owners of token id 0.

Tools Used

Foundry

Recommendations

Change starting tokenId in Soulmate.sol to 1 and only allow users with token ID greater than 1 to write messages.

+ error Soulmate__dontHaveASoulmate();
...
+ uint256 private nextID = 1;
....
function writeMessageInSharedSpace(string calldata message) external {
uint256 id = ownerToId[msg.sender];
+ if(id == 0) revert();
sharedSpace[id] = message;
emit MessageWrittenInSharedSpace(id, message);
}
...
function totalSupply() external view returns (uint256) {
- return nextID;
+ return nextID-1;
}
​
function totalSouls() external view returns (uint256) {
- return nextID * 2;
+ return (nextID-1) * 2;
}
​
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-write-message-nft-0-id

Medium Severity, This has an indirect impact and influence on the possibility of divorce between soulmates owning the first soulmate NFT id0, leading to permanent loss of ability to earn airdrops/staking rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.