Submission Details
Severity:
`Airdrop.sol` is performing wrong the check on the soulmate's matrial status
[H-2] Airdrop.sol is performing wrong the check on the soulmate's matrial status
Description: The soulmates can only claim the airdrop if they are not divorced, however the contract is checking its own matrial status instead of the msg.sender's.
Impact: Divorced soulmates will be able to claim their tokens:
function claim() public {
// No LoveToken for people who don't love their soulmates anymore.
if (soulmateContract.isDivorced()) revert Airdrop__CoupleIsDivorced();
Proof of Concept: Place the following in AirdropTest.t.sol:
function test_DivorcedCoupleCanClaim() public {
_mintOneTokenForBothSoulmates();
vm.startPrank(soulmate1);
soulmateContract.getDivorced();
vm.warp(block.timestamp + 1 days);
airdropContract.claim();
vm.stopPrank();
assertTrue(
loveToken.balanceOf(soulmate1) == 10 ** loveToken.decimals()
);
}
Recommended Mitigation: Modify Soulmate.sol::isDivorced() so that Airdrop.sol can check the specific user's status:
function isDivorced(address soulmate) public view returns (bool) {
return divorced[soulmate];
}
Updates
Lead Judging Commences
0xnevi over 1 year ago
Submission Judgement Published Assigned finding tags:
finding-isDivorced-wrong-check
Rewards breakdown
nSLOC
233This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.