First Flight #9: Soulmate

Beginner FriendlyFoundryNFT
100 EXP
Submission Details
Severity: high
Valid

Divorced soulmates can still `claim` the `airdrop`

Updates

Lead Judging Commences

0xnevi Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-claim-airdrop-without-owning-NFT

High severity, This issue is separated from the flawed `isDivorced()` check presented in issue #168 as even if that is fixed, if ownership is not checked, isDivorced would still default to false and allow bypass to claim airdrops by posing as tokenId 0 in turn resulting in this [important check for token claim is bypassed.](https://github.com/Cyfrin/2024-02-soulmate/blob/b3f9227942ffd5c443ce6bccaa980fea0304c38f/src/Airdrop.sol#L61-L66). #220 is the most comprehensive issue as it correctly recognizes both issues existing within the same function.

0xe4669da Submitter
8 months ago
0xe4669da Submitter
8 months ago
0xnevi Lead Judge
8 months ago
0xe4669da Submitter
8 months ago
0xnevi Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isDivorced-wrong-check

Support

FAQs

Can’t find an answer? Join our Discord or follow us on Twitter.