First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Any user can write a message in first shared space

ceseshi

Summary

Users without a soulmate can write a message in the shared space at the first position.

Vulnerability Details

The writeMessageInSharedSpace() function in Soulmate.sol does not check if the sender has a soulmate. This allows any user to write a message in the shared space of the first soulbound token.

function testAnyUserCanWriteMessage() public {
string memory message = "Hello!";
address alice = makeAddr("alice");
​
// Create a user without a soulmate
vm.prank(alice);
// Write and read a message
soulmateContract.writeMessageInSharedSpace(message);
uint256 tokenId = 0;
string memory sharedMessage = soulmateContract.sharedSpace(tokenId);
​
assertTrue(keccak256(abi.encodePacked(sharedMessage)) == keccak256(abi.encodePacked(message)));
}

The test confirms the message was written to position zero.

Running 1 test for test/unit/AuditTest1.t.sol:AuditTest1
[PASS] testAnyUserCanWriteMessage() (gas: 40523)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.79ms

Impact

Any user can leave a message in the private space of soulbound token zero, as if it was any of the soulmates.

Tools Used

Foundry, Manual review

Recommendations

Add a soulmate check in Soulmate:mintSoulmateToken()

function writeMessageInSharedSpace(string calldata message) external {
+ if(soulmateOf[msg.sender] == address(0)) revert Soulmate__noSoulmate();
uint256 id = ownerToId[msg.sender];
sharedSpace[id] = message;
emit MessageWrittenInSharedSpace(id, message);
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-write-message-nft-0-id

Medium Severity, This has an indirect impact and influence on the possibility of divorce between soulmates owning the first soulmate NFT id0, leading to permanent loss of ability to earn airdrops/staking rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.