First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

A SharedSpace with an NTFid of 0 can be written by any caller who does not have a soulmate.

shaflow01

A SharedSpace with an NTFid of 0 can be written by any caller who does not have a soulmate.

Vulnerability Details

uint256 id = ownerToId[msg.sender];
sharedSpace[id] = message;
emit MessageWrittenInSharedSpace(id, message);

When the caller does not have an NFT, ownerToId[msg.sender] will return 0. Therefore, a SharedSpace with an NTFid of 0 can be written by any caller who does not have any soulmate.

Impact

A SharedSpace with an NTFid of 0 can be written by any caller who does not have a soulmate.

Tools Used

Manual Review

Recommendations

Check if the caller has a soulmate.

require(soulmateOf[msg.sender]!=address(0));
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-write-message-nft-0-id

Medium Severity, This has an indirect impact and influence on the possibility of divorce between soulmates owning the first soulmate NFT id0, leading to permanent loss of ability to earn airdrops/staking rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.