Description: The Soulmate.sol::getDivorced
function marks both parties as divorced, but it does not update soulmateOf
, idToOwners
, or ownerToId
mappings to reflect this change in state. Therefore, even after divorce, the contract still considers the parties as connected soulmates in terms of token ownership and permissions
Impact: Divorced soulmates will still accrue staking rewards and are able to use the Soulmate.sol::writeMessageInSharedSpace
and Soulmate.sol::readMessageInSharedSpace
functions.
Proof of concept: Add this test into the SoulmateTest.t.sol
file.
In order for the test to work, you will need to also change the BaseTest.t.sol::_giveLoveTokenToSoulmates
function.
We are doing this because inside the test we mint the NFTs manually before divorcing. The _depositTokenToStake
function calls this _giveLoveTokenToSoulmates
function, which calls _mintOneTokenForBothSoulmates
again, and the test will revert with the Soulmate.sol::Soulmate__alreadyHaveASoulmate
error. Essentially it tries to mint NFTs again, and the test will not go through.
By temporarily removing this line we can avoid this error, and you can see that divorced soulmates will still accrue staking rewards.
Recommended mitigation: Ensure that the Soulmate.sol::getDivorced
function marks both parties as divorced, and updates soulmateOf
, idToOwners
, or ownerToId
mappings to reflect this change in state.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.