First Flight #9: Soulmate

Summary

Soulmate :: writeMessageInSharedSpace() function allows any soulmates with the same NFT ID to write in a shared space on blockchain.But there is possible that the persons who have no NFT ID can also write and read there.

Vulnerability Details

In Soulmate :: writeMessageInSharedSpace() function we are checking for soulmate by ownerToId[msg.sender]. But what If the person who calls this function for writing message have no NFT ID can also write and read message there.

Code Snippet

 function writeMessageInSharedSpace(string calldata message) external {
    // @audit : Lack of check that either soulmate exist or not.  
    uint256 id = ownerToId[msg.sender];
    sharedSpace[id] = message;
    emit MessageWrittenInSharedSpace(id, message);
} 

Impact

The impact is this there is no control on only soulmates can add the touch of romantism according to documentation.

POC

    function test_auditWriteAndReadSharedSpace() public {
    vm.prank(address(1));
    soulmateContract.writeMessageInSharedSpace("Buy some eggs");
    vm.prank(address(2));
   
    string memory message = soulmateContract.readMessageInSharedSpace();

    string[4] memory possibleText = [
        "Buy some eggs, sweetheart",
        "Buy some eggs, darling",
        "Buy some eggs, my dear",
        "Buy some eggs, honey"
    ];
    bool found;
    for (uint i; i < possibleText.length; i++) {
        if (compare(possibleText[i], message)) {
            found = true;
            break;
        }
    }
    console2.log(message);
    assertTrue(found);
}

Tools Used

Foundry

Recommendations

Add a check that the person must have soulmate exist before it write message to shared space.

    function writeMessageInSharedSpace(string calldata message) external {
    address soulmate2 = soulmateOf[msg.sender];
     require(soulmate2!=address(0));
    uint256 id = ownerToId[msg.sender];
    sharedSpace[id] = message;
    emit MessageWrittenInSharedSpace(id, message);
}

POC :

Now only person have soulmates can write message.

    function test_writemessagerevertforsinglepeople() public {
    vm.prank(address(1));
    vm.expectRevert();
    soulmateContract.writeMessageInSharedSpace("Buy some eggs");
    }