First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of access control allows uninitialized soulmates to read and write message in `Soulmate:readMessageInSharedSpace` and `Soulmate:writeMessageInSharedSpace`

maziXYZ

Summary

Default value uint256 is 0 for the ownerToId mapping in the Soulmate contract. Hence, the lack of access control within the readMessageInSharedSpace and writeMessageInSharedSpace allows uninitialized addresses in the ownerToId mapping to read and write messages within the shared space.

Vulnerability Details

Within your foundry test suite, set up your Test based contract and initialize Soulmate contract and paste the below code blocks.

Code
function setUpSoulmates() public {
vm.prank(soulmate1);
soulmateContract.mintSoulmateToken();
​
vm.prank(soulmate2);
soulmateContract.mintSoulmateToken();
assertEq(soulmateContract.soulmateOf(soulmate1), soulmate2);
}
​
function testNonSoulmateCanSendMessageToSharedSpaceIdZero() public {
setUpSoulmates();
// there should be no message since neither soulmates has sent a message
uint256 timestamp = 3;
vm.prank(soulmate1);
vm.warp(timestamp);
string memory message = soulmateContract.readMessageInSharedSpace();
assertEq(message, ", honey");
​
address notASoulmate = makeAddr("notASoulmate");
​
vm.prank(notASoulmate);
soulmateContract.writeMessageInSharedSpace("some new message");
​
// let's get the message in sharedSpace[0]
vm.prank(soulmate2);
assertEq(message, soulmateContract.readMessageInSharedSpace());
}

Run the test with the command below:

forge test --mt testNonSoulmateCanSendMessageToSharedSpaceIdZero -vvvvv

Failed result output:

[FAIL. Reason: assertion failed] testNonSoulmateCanSendMessageToSharedSpaceIdZero() (gas: 68731)
Logs:
Error: a == b not satisfied [string]
Left: , honey
Right: some new message, honey

Impact

Soulmates with NFT ID == 0 cannot enjoy the shared space privilege since some uninitialized address in ownerToId mapping can participate.

Tools Used

  • Foundry

  • Manual Code Review

Recommendations

function readMessageInSharedSpace() external view returns (string memory) {
+ require(idToOwners[ownerToId[msg.sender]][0] == msg.sender || idToOwners[ownerToId[msg.sender]][1] == msg.sender);
...
function writeMessageInSharedSpace(string calldata message) external {
+ require(idToOwners[ownerToId[msg.sender]][0] == msg.sender || idToOwners[ownerToId[msg.sender]][1] == msg.sender);
...
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-write-message-nft-0-id

Medium Severity, This has an indirect impact and influence on the possibility of divorce between soulmates owning the first soulmate NFT id0, leading to permanent loss of ability to earn airdrops/staking rewards.

maziXYZ Submitter
over 1 year ago
0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-write-message-nft-0-id

Medium Severity, This has an indirect impact and influence on the possibility of divorce between soulmates owning the first soulmate NFT id0, leading to permanent loss of ability to earn airdrops/staking rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.