First Flight #9: Soulmate

Summary

When a user claims their airdrop using the Airdrop.sol claim() function a check is executed to verify if the soulmate is divorced, this is done using the soulmate contract isDivorced() function which checks the divorced boolean status of msg.sender. The problem is that when performing this call msg.sender is not the user that called the claim() method but the address of the Airdrop.sol contract.

Vulnerability Details

msg.sender doesn't stay the same for external calls inside the function that is called by a user.

Impact

High. Breaks intended functionality for the "divorced" users of the soulmate contract, it never does that revert.

Tools Used

Manual Analysis

Recommendations

Change the isDivorced() functionality to check based on user argument.