Submission Details
Severity:
Malicious user can divorce just to prevent other users from getting tokens
Summary
Malicious user can prevent another user from being able to claim tokens by divorcing. Ideally divorce should be a mutul agreement.
Vulnerability Details
getDivorced() function only needs one of the soulmates to prevent both users from being able to claim any tokens.
Impact
Medium. This affects one of the users only if there is malicious intent from one of the soulmates.
Tools Used
Manual analysis
Recommendations
Add a mapping to contain the current divorce status of both soulmates, when both are true, meaning both executed the getDivorced() function then set their divorced mapping status to true.
function getDivorced() public {
address soulmate2 = soulmateOf[msg.sender];
+ wantsDivorce[msg.sender] = true;
+ if(wantsDivorce[soulmate2]) {
divorced[msg.sender] = true;
divorced[soulmateOf[msg.sender]] = true;
emit CoupleHasDivorced(msg.sender, soulmate2);
+ }
}
Rewards breakdown
nSLOC
233This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.