First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

The Soulmate::writeMessageInSharedSpace function is available for use by individuals who have previously undergone divorce

naman1729

Summary

  • This function is intended to provide a means for individuals who are not divorced and are committed to one another to communicate through a shared space on the blockchain. However, the current implementation does not adequately restrict access, allowing divorced parties to continue writing messages in the shared space, which is contrary to the intended design and usage.

Vulnerability Details

  • This function have no check for the msg.sender for checking the person is Soulmate or Divorce

​
/// @notice Allows any soulmates with the same NFT ID to write in a shared space on blockchain.
/// @param message The message to write in the shared space.
@> function writeMessageInSharedSpace(string calldata message) external {
uint256 id = ownerToId[msg.sender];
sharedSpace[id] = message;
emit MessageWrittenInSharedSpace(id, message);
}
​

POC

  • this is a test function which test the Soulmate::writeMessageInSharedSpace function.

  • this function pass which make the current implementation does not adequately restrict access, allowing divorced parties to continue writing messages in the shared space

function test_isNotSoulmateUseWriteMessageInSharedSpace() public {
_mintOneTokenForBothSoulmates();
string memory message = "Hello!!";
vm.prank(soulmate1);
soulmateContract.getDivorced();
​
vm.prank(soulmate1);
soulmateContract.writeMessageInSharedSpace(message);
​
vm.prank(soulmate2);
string memory receiveMessage = soulmateContract.sharedSpace(soulmateContract.ownerToId(msg.sender));
​
assertEq(message, receiveMessage);
}

Impact

  • Lack of Access Control

  • Inadequate Design and Usage of Function

Tools Used

  • Manual Review

Recommendations

  • we can create these changes to correct the design and usage of this function.

+ error Soulmate__CoupleIsDivorced();
​
​
+ modifier isSoulmates {
+ if(isDivorced()){
+ revert Soulmate__CoupleIsDivorced();
+ }
+ _;
+ }
​
- function writeMessageInSharedSpace(string calldata message) external {
+ function writeMessageInSharedSpace(string calldata message) external isSoulmates {
uint256 id = ownerToId[msg.sender];
sharedSpace[id] = message;
emit MessageWrittenInSharedSpace(id, message);
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.