First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Anyone can write to shared space with id of 0

octeezy

Summary

To get the token id for the shared space ownerToId[msg.sender] is checked. If this entry doesn exist it returns zero. Meaning that because the writeMessageInSharedSpace function is external anyone who is or isn't a soulmate can call it and write to the sharedSpace with id of 0.

Vulnerability Details

Unset uint variables return 0. Something similar in mappings where an unset mapping that whould return a uint will return 0.
This means that uint256 id = ownerToId[msg.sender]; will result in id being equal to zero when the ownerToId of that msg.sender has not been set, this overwrites the sharedSpace for soulmates that share the nextID of 0 and opens up this shared space for anyone willing to spend some gas to write something there.

Impact

High. Incorrect functionality for some users.

Tools Used

Foundry test.

function test_evilWriteToSharedSpace() public {
vm.prank(evilMate);
soulmateContract.writeMessageInSharedSpace("Bad word");
​
vm.prank(anyOtherAddr);
string memory message = soulmateContract.readMessageInSharedSpace();
​
string[4] memory possibleText = [
"Bad word, sweetheart",
"Bad word, darling",
"Bad word, my dear",
"Bad word, honey"
];
bool found;
for (uint i; i < possibleText.length; i++) {
if (compare(possibleText[i], message)) {
found = true;
break;
}
}
console2.log(message);
assertTrue(found);
}

Recommendations

Add an extre check to verify that msg.sender really is one of the owners of the token.

function writeMessageInSharedSpace(string calldata message) external {
uint256 id = ownerToId[msg.sender]; // @audit - high - anyone who hasnt minted can write to id 0.
+ if(idToOwners[id][0] == msg.sender || idToOwners[id][1] == msg.sender) {
sharedSpace[id] = message;
emit MessageWrittenInSharedSpace(id, message);
+ } else {
+ revert Soulmate_isNotTheOwner();
+ }
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-write-message-nft-0-id

Medium Severity, This has an indirect impact and influence on the possibility of divorce between soulmates owning the first soulmate NFT id0, leading to permanent loss of ability to earn airdrops/staking rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.