Soulmate::totalSouls
inaccurately calculates the total number of paired souls. This function currently returns a value that assumes all minting actions result in successful pairings, thereby doubling the nextID
to represent total souls. However, this calculation does not account for users who are still awaiting pairing or those who have been incorrectly paired with themselves, leading to a misrepresented count of active soulmate pairs within the system.
The totalSouls
function's simplistic calculation method (return nextID * 2;) overlooks two critical scenarios:
Unpaired Souls: Users who have initiated the minting process but are not yet paired. These users should not contribute to the total count of souls until their pairing is confirmed.
Self-Paired Users: The current logic does not prevent a user from being paired with themselves.
The provided test case illustrates this issue by demonstrating that the totalSouls
count can be inaccurate immediately after a minting request and can also reflect an incorrect increment when a user is allowed to pair with themselves.
Proof of code:
The inaccurate reporting of total souls impacts the transparency and reliability of the protocol's metrics. It could mislead users and stakeholders about the platform's activity level and the actual number of successful pairings, potentially affecting user trust and engagement.
Manual review.
The following modifications are recommended:
Prevent Self-Pairing: Implement checks within the minting function to prevent users from being paired with themselves, ensuring that all pairings are between distinct users:
Rename the function and change its implementation so that it returns the number of pairs, not the number of souls:
Low severity, given `totalSouls()` is simply a view function not used anywhere else in the protocol. There are several instances that can cause wrong values: 1. When there are pending soulmates not yet paired, but `nextId` has already been incremented 2. Divorced soulmates are still included in computation of totalSouls
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.