anyone can claim airdrops because of valid soulmateId 0
Summary
anyone can claim airdrops because of valid soulmateId 0
Vulnerability Details
Alice does not mint soulmate token.
When Alice wants to claim aipdrop tokens, smart contract will try to get soulmateId by soulmateContract.ownerToId(msg.sender). return value 0 is one valid value.
Alice can claim airdrops.
Impact
Anyone can claim airdrops, not only people who has one soulmate.
Tools Used
Manual
Recommendations
Make sure people who claim airdrop has one soulmate and not divorced.
Lead Judging Commences
finding-claim-airdrop-without-owning-NFT
High severity, This issue is separated from the flawed `isDivorced()` check presented in issue #168 as even if that is fixed, if ownership is not checked, isDivorced would still default to false and allow bypass to claim airdrops by posing as tokenId 0 in turn resulting in this [important check for token claim is bypassed.](https://github.com/Cyfrin/2024-02-soulmate/blob/b3f9227942ffd5c443ce6bccaa980fea0304c38f/src/Airdrop.sol#L61-L66). #220 is the most comprehensive issue as it correctly recognizes both issues existing within the same function.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.