A single person having multiple accounts will be able to be in relation and enjoy the benefits of LoveToken
Summary
The Soulmate::mintSoulmateToken function allows users to find and make soulmates but due to the fact that single user can have multiple addresses can form infinite number of soulmates and take all the benefits of LoveToken, which will ultimately create scarcity of LoveToken.
Vulnerability Details
The vulnerability occurs due to the function mintSoulmateToken doesn't check for unique identity of the msg.sender as a result of which a single person can have multiple addresses and be in relation with each one of them via which they can enjoy the benefits of LoveToken.
The user can form a large number of soulmates with their own addresses, which will create scarcity of LoveToken in the protocol and ultimately it will end, as a result of which the real soulmates will not be able to enjoy the LoveToken as it is limited.
Impact
Leads to creation of fake soulmates and minting of a large amount of LoveToken leading to its scarcity.
Tools Used
Manual Review
Recommendations
Use external off-chain services to verify the identity of user and allow only unique users to call mintSoulmateToken exactly one time.
Lead Judging Commences
finding-self-soulmate
- Given the native anonymous nature of blockchain in general, this issue cannot be avoided unless an explicit whitelist is implemented. Even then we can only confirm soulmates are distinct individuals via kyc. I believe finding a soulmate is intended to be permisionless. - However, even though sufficient (500_000_000e18 in each vault) tokens are minted to claim staking and airdrop rewards, it would take 500_000_000 / 2 combined weeks for airdrop vault to be drained which is not unreasonable given there are [80+ million existing wallets](https://coinweb.com/trends/how-many-crypto-wallets-are-there/). Given there is no option to mint new love tokens, this would actually ruin the functionality of the protocol of finding soulmates and shift the focus to abusing a sybil attack to farming airdrops instead. Assigning medium severity for now but am open for appeals otherwise, since most if not all issues lack indepth analysis of the issue.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.