Submission Details
Severity:
Soulmate.getDivorced does not update the current soulmates (soulMateOf)
Summary
Soulmate.getDivorced does not update the current soulmates mapping soulMateOf thus two souls appear to still be in love also after they divorced.
Vulnerability Details
The function getDivorced is updating only the divorced mapping. The divorced couple still appear as soulmates afterwards.
function getDivorced() public {
address soulmate2 = soulmateOf[msg.sender];
divorced[msg.sender] = true;
divorced[soulmateOf[msg.sender]] = true;
emit CoupleHasDivorced(msg.sender, soulmate2);
}
Impact
A divorced couple still appear as soulmates.
Tools Used
Manual code review.
Recommendations
function getDivorced() public {
address soulmate2 = soulmateOf[msg.sender];
divorced[msg.sender] = true;
divorced[soulmate2] = true;
// update soulMateOf
soulmateOf[msg.sender] = address(0);
soulmateOf[soulmate2] = address(0);
emit CoupleHasDivorced(msg.sender, soulmate2);
}
Rewards breakdown
nSLOC
233This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.