First Flight #9: Soulmate

Summary

The Soulmate contracts track the total number of soulbound by calculating nextID * 2 in the SoulToken contract. However, the actual minting logic only creates an NFT for one of the two soulmates per pair. This leads to an inaccurate total soul count.

Vulnerability Details

The specific code calculating total souls is:

Impact

The impacts from this inaccurate tracking are:

Inflated soul count compared to actual on-chain NFT mints
Misleading to dApp users expecting NFTs for both soulmates
Reduces integrity of the contracts by enabling fake growth metrics

Tools Used

Manaul Review

Recommendations

To address this, the team should:

Audit actual wallet mints and fix the counting logic
Update UI/UX language to explain actual single mints
Mint both NFTs per pair or adjust messaging of "total souls"
Accurately conveying the 1 NFT per soulmate pair would set better user expectations and increase transparency.