Soulmate NFT Bypass leads to Front-running mint attack
Summary
The Airdrop::claim function allows users to claim tokens without owning a Soulmate NFT. An attacker can frontrun the first mint, mint block.timestamp/86400 tokens, potentially exploiting the system.
Vulnerability Details
The Airdrop::claim function only checks if the user isDivorced which defaults to false for everyone including people who don't own an NFT. The attacker can take this to his advantage and calls claim. soulmateContract.ownerToId(msg.sender) and soulmateContract.idToCreationTimestamp result to 0 as default values. numberOfDaysInCouple will be block.timestamp/86400 which is the amount the attacker is able to exploit
Impact
Attackers can exploit the system by claiming tokens without the necessary ownership requirements, leading to unfair token distribution and potential abuse of the airdrop mechanism.
Tools Used
Manual Audiitng
Recommendations
Implement a check in the claim function to ensure that users own a Soulmate NFT before allowing them to claim tokens.
Lead Judging Commences
finding-claim-airdrop-without-owning-NFT
High severity, This issue is separated from the flawed `isDivorced()` check presented in issue #168 as even if that is fixed, if ownership is not checked, isDivorced would still default to false and allow bypass to claim airdrops by posing as tokenId 0 in turn resulting in this [important check for token claim is bypassed.](https://github.com/Cyfrin/2024-02-soulmate/blob/b3f9227942ffd5c443ce6bccaa980fea0304c38f/src/Airdrop.sol#L61-L66). #220 is the most comprehensive issue as it correctly recognizes both issues existing within the same function.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.