First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`Soulmate::mintSoulmateToken()` allows anyone to soulmate with himself

0xlrivo

Summary

Anyone can soulmate with himself.

Vulnerability Details

Due to the missing check when the second person calls Soulmate::mintSoulmateToken(), the first soulmate can call the function twice and soulmate with himself.

Impact

Even if this doesn't break the other functionalities in major ways, it goes against the protocol's main goal (soulmate with another random individual).

Tools Used

Add the following uint test to SoulmateTest.t.sol:

function test_canSoulmateWithMySelf() public {
vm.startPrank(soulmate1);
soulmateContract.mintSoulmateToken();
soulmateContract.mintSoulmateToken();
assertTrue(soulmateContract.soulmateOf(soulmate1) == soulmate1);
vm.stopPrank();
}

Recommendations

Add the missing check in the else if block of the function:

else if (soulmate2 == address(0)) {
require(soulmate1 != msg.sender, "Can't soulmate with yourself");
idToOwners[nextID][1] = msg.sender;
// ...
_mint(msg.sender, nextID++);
}

Alternatively you can also add this line after the memory variable soulmate1 is initialised to save some gas:

address soulmate1 = idToOwners[nextID][0];
require(soulmate1 != msg.sender, "Can't soulmate with yourself");
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-self-soulmate

- Given the native anonymous nature of blockchain in general, this issue cannot be avoided unless an explicit whitelist is implemented. Even then we can only confirm soulmates are distinct individuals via kyc. I believe finding a soulmate is intended to be permisionless. - However, even though sufficient (500_000_000e18 in each vault) tokens are minted to claim staking and airdrop rewards, it would take 500_000_000 / 2 combined weeks for airdrop vault to be drained which is not unreasonable given there are [80+ million existing wallets](https://coinweb.com/trends/how-many-crypto-wallets-are-there/). Given there is no option to mint new love tokens, this would actually ruin the functionality of the protocol of finding soulmates and shift the focus to abusing a sybil attack to farming airdrops instead. Assigning medium severity for now but am open for appeals otherwise, since most if not all issues lack indepth analysis of the issue.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.