A user can claim loveToken without having a soulmate
Summary
A user can claim loveToken event if he hasn't got a soulmate.
At least one person must have claimed a Soulmate NFT to use this bug.
Vulnerability Details
If soulmate1 and soulmate2 are soulmates since 200 days, then a soulmate3 address can claim loveToken.
This is due to the variable nextID which is initialized to 0 in the contract Soulmate.sol.
The id returned by the function idToCreationTimestamp() when given 0 as the parameter will return the timestamp of soulmates soulmate1 and soulmate2, so 200 days in seconds in my exemple.
Impact
Low or medium.
Tools Used
Recommendations
Set the variable nextId in the Soulmate contract to 1.
Lead Judging Commences
finding-claim-airdrop-without-owning-NFT
High severity, This issue is separated from the flawed `isDivorced()` check presented in issue #168 as even if that is fixed, if ownership is not checked, isDivorced would still default to false and allow bypass to claim airdrops by posing as tokenId 0 in turn resulting in this [important check for token claim is bypassed.](https://github.com/Cyfrin/2024-02-soulmate/blob/b3f9227942ffd5c443ce6bccaa980fea0304c38f/src/Airdrop.sol#L61-L66). #220 is the most comprehensive issue as it correctly recognizes both issues existing within the same function.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.