First Flight #9: Soulmate

Summary

The Airdrop contract in the current LoveToken ecosystem is designed to allow holders of Soulmate NFTs to claim LoveTokens on a daily basis, underpinning a unique engagement model that rewards sustained relationships. However, the absence of an explicit ownership check for Soulmate NFTs within the claim function permits any address to trigger the airdrop claim process, potentially leading to unauthorized LoveToken acquisition.

Vulnerability Details

The core issue resides in the claim function, which lacks a crucial verification step to ensure that the caller is indeed the owner of a Soulmate NFT. The function soulmateContract.isDivorced() is invoked to check the divorce status of a couple but fails to ascertain if the caller possesses a Soulmate NFT. This oversight allows any user to execute the claim function, disregarding the intended restriction that only Soulmate NFT owners are eligible for the daily LoveToken airdrop.

POC

Impact

This vulnerability could lead to several adverse outcomes, including but not limited to:

• Dilution of LoveToken value due to unauthorized claim and distribution.

• Erosion of trust among legitimate NFT holders regarding the exclusivity and benefits of holding Soulmate NFTs.

• Potential depletion of the LoveToken reserves allocated for the airdrop, denying rightful claims by actual NFT owners.

Tools Used

• Manual code review.

Recommendations

To mitigate this vulnerability and prevent unauthorized LoveToken claims, implement an ownership verification step within the claim function. This can be achieved by adding a check to confirm that the caller owns a Soulmate NFT before proceeding with the claim process. Also, minting ids should start from 1, Here's an enhanced version of the critical part of the claim function:

It's important to ensure that the ownerToId function in the ISoulmate contract accurately reflects ownership of Soulmate NFTs, returning a non-zero identifier only for legitimate owners. This modification introduces an additional gas cost for the ownership check but significantly enhances the security and integrity of the airdrop mechanism.