First Flight #9: Soulmate

Beginner FriendlyFoundryNFT
100 EXP
Submission Details
Severity: high
Valid

A user that mints soul token and is not matched can claim large amound of love tokens in Airdrop contract

Updates

Lead Judging Commences

0xnevi Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-claim-airdrop-without-owning-NFT

High severity, This issue is separated from the flawed `isDivorced()` check presented in issue #168 as even if that is fixed, if ownership is not checked, isDivorced would still default to false and allow bypass to claim airdrops by posing as tokenId 0 in turn resulting in this [important check for token claim is bypassed.](https://github.com/Cyfrin/2024-02-soulmate/blob/b3f9227942ffd5c443ce6bccaa980fea0304c38f/src/Airdrop.sol#L61-L66). #220 is the most comprehensive issue as it correctly recognizes both issues existing within the same function.

Support

FAQs

Can’t find an answer? Join our Discord or follow us on Twitter.