Summary

The Soulmate contains potential vulnerabilities related to the handling of messages in the shared space. Two main issues have been identified: the lack of persistence for message history and the absence of limits on the number of messages a user can write.

Vulnerability Details

The current implementation overwrites the existing message in the shared space on each new request, resulting in a lack of message history.

Also, there is no restriction on the number of messages a user can write in the shared space, potentially leading to abuse and spam.

Impact

1. Lack of Message Persistence:

   • Severity: Moderate

   • Consequence: Users may lose access to or reference previous messages, limiting the collaborative and interactive features of the shared space.

2. Unlimited Message Writing:

   • Severity: Moderate

   • Consequence: Malicious users could flood the shared space with an unlimited number of messages, impacting usability and readability.

POC

• Run the below test via cmd forge test --match-test testWriteMessageInSharedSpaceUnlimited -vvvv

Recommendations

1. Message History Preservation:

   • Recommendation: Modify the writeMessageInSharedSpace function to append new messages to the existing content in the shared space, allowing for the preservation of message history.

   • Example:

     function writeMessageInSharedSpace(string calldata message) external {

     uint256 id = ownerToId[msg.sender];

     sharedSpace[id] = string.concat(sharedSpace[id], " ", message); // Append message instead of overwriting

     emit MessageWrittenInSharedSpace(id, message);

     }

2. Limit on Message Writing:

   • Recommendation: Implement limitations on the frequency or volume of messages a user can write in the shared space to prevent abuse and maintain a manageable shared space.

   • Example:

     modifier limitMessageWriting() {

     // Implement logic to check and limit the frequency or volume of messages

     _;

     }

     ​

     function writeMessageInSharedSpace(string calldata message) external limitMessageWriting {

     uint256 id = ownerToId[msg.sender];

     sharedSpace[id] = string.concat(sharedSpace[id], " ", message);

     emit MessageWrittenInSharedSpace(id, message);

     }