First Flight #9: Soulmate

Summary

The _mint function is called for the second soulmate, this means that on wallets and exchanges only the second soulmate will appear to have that token.

Vulnerability Details

Only one user being the true owner of the actual token breaks the core idea of 2 soulmates co-owning a soulbound token.

Impact

High. Breaks the intended functionality of the contract.

Tools Used

Manual Analysis

Recommendations

Instead of extending an ERC721 contract the Soulmate contract whould have it's own token ownership implementation, that way it doesn't break the ERC721 single token ownership.