Wrong result in Soulmate::totalSouls
function, could cause a participant to enter again and be his own soulmate
Description:
If an USER call the Soulmate::totalSouls
to see the numbers of participants before apply on Soulmate::mintSoulmateToken
, and apply being the soulmate[0], when the USER checks Soulmate::totalSouls
again, the value will be the same. So the user could try Soulmate::mintSoulmateToken
again and he will became his own soulmate.
Impact:
This problem could cause many people to became their own soulmates.
Proof of Code:
USER call the Soulmate::totalSouls
Receive a number
Call Soulmate::mintSoulmateToken
If the USER is the soulmate[0]
, he will call Soulmate::totalSouls
and receive the same number
User could call Soulmate::mintSoulmateToken
again, trying to enter on a second time.
Now the Soulmate::totalSouls
will update. However, the user will be his own soulmate.
Recommendation:
We can add a counter in Soulmate::mintSoulmateToken
to count soulmates
- Given the native anonymous nature of blockchain in general, this issue cannot be avoided unless an explicit whitelist is implemented. Even then we can only confirm soulmates are distinct individuals via kyc. I believe finding a soulmate is intended to be permisionless. - However, even though sufficient (500_000_000e18 in each vault) tokens are minted to claim staking and airdrop rewards, it would take 500_000_000 / 2 combined weeks for airdrop vault to be drained which is not unreasonable given there are [80+ million existing wallets](https://coinweb.com/trends/how-many-crypto-wallets-are-there/). Given there is no option to mint new love tokens, this would actually ruin the functionality of the protocol of finding soulmates and shift the focus to abusing a sybil attack to farming airdrops instead. Assigning medium severity for now but am open for appeals otherwise, since most if not all issues lack indepth analysis of the issue.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.