First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Any user can call `Soulmate::writeMessageInSharedSpace()` to write a message

glitchical

Summary

Any user that hasn't minted via Soulmate::mintSoulmateToken() will be able to call the Soulmate::writeMessageInSharedSpace() to write a message to NFT ID #0.

Vulnerability Details

The Soulmate::writeMessageInSharedSpace() is intended for soulmates to write messages in their shared space. However, if a user hasn't minted a soulmate, this results in the id local variable to be set to 0:

function writeMessageInSharedSpace(string calldata message) external {
@> uint256 id = ownerToId[msg.sender];
sharedSpace[id] = message;
emit MessageWrittenInSharedSpace(id, message);
}

Since id will be set to 0, the message will be written to sharedSpace[0] which belongs to soulmates that own NFT ID #0.

Impact

This results in incorrect handling of state since anyone can write to sharedSpace[0].

POC

You can see the following foundry test where a non-soulmate modifies the state

function test_WriteAndReadSharedSpace() public {
address attacker = makeAddr("attacker");
vm.prank(attacker);
soulmateContract.writeMessageInSharedSpace("Get rekt");
​
vm.prank(soulmate2);
string memory message = soulmateContract.readMessageInSharedSpace();
​
string[4] memory possibleText = [
"Get rekt, sweetheart",
"Get rekt, darling",
"Get rekt, my dear",
"Get rekt, honey"
];
bool found;
for (uint i; i < possibleText.length; i++) {
if (compare(possibleText[i], message)) {
found = true;
break;
}
}
console2.log(message);
assertTrue(found);
}

Tools Used

VS Code, Foundry

Recommendations

Add a new error and check the soulmateOf mapping to see if msg.sender has a soulmate before writing messages:

+ error Soulmate__NoSoulmate();
​
function writeMessageInSharedSpace(string calldata message) external {
+ if (soulmateOf(msg.sender) == address(0))
+ revert Soulmate__NoSoulmate();
uint256 id = ownerToId[msg.sender];
sharedSpace[id] = message;
emit MessageWrittenInSharedSpace(id, message);
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-write-message-nft-0-id

Medium Severity, This has an indirect impact and influence on the possibility of divorce between soulmates owning the first soulmate NFT id0, leading to permanent loss of ability to earn airdrops/staking rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.