Submission Details
Severity:
Check if the sender is the owner of the token ID in `writeMessageInSharedSpace()::Soulmate.sol` contract.
Summary
The writeMessageInSharedSpace() function does not check if the sender is the owner of the token ID before writing to the shared space.
Impact
This could allow anyone to write messages in the shared space of any token ID.
Tools Used
Manually
Recommendations
Add a require statement inside the writeMessageInSharedSpace() function, that checks sender is the owner of token ID or not
+ require(idToOwners[id][0] == msg.sender || idToOwners[id][1] == msg.sender, "Sender is not the owner of the token ID");
Rewards breakdown
nSLOC
233This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.