First Flight #9: Soulmate

Summary

The claimAirdrop function lacks validation to determine whether the user is reunited or not. If a user who is not reunited attempts to claim the reward, the idToCreationTimestamp mapping value remains the default, resulting in a calculation error. This miscalculation could lead to a significant value for numberOfDaysInCouple, potentially exceeding the balance of the vault contract and causing the withdrawal of all funds.

Vulnerability Details

If a user is not reunited, either because they minted a soulmate NFT but did not find a match or did not mint an NFT at all, attempting to claim the reward in the Airdrop leads to an issue. The idToCreationTimestamp mapping value is not updated, remaining at the default zero value. The calculation of numberOfDaysInCouple becomes the pure result of block.timestamp / daysInSecond, representing the days since the initial block creation. Consequently, the tokenAmountToDistribute becomes excessively large, potentially causing the user to drain all funds in the Airdrop vault contract.

Impact

A test scenario exemplifies this potential issue:

In this case, soulmate1, who did not mint any tokens, still receives 10,000 love tokens as a reward, deviating from the intended specification.

Tools Used

Manual Review

Recommendations

To address this vulnerability, it is recommended to add validation checks to determine whether the user is reunited or not. Additionally, consider validating whether idToCreationTimestamp is at its default value before proceeding with the reward claim.