Submission Details
Severity:
Soulmate token gets only minted for the second soulmate
Description: The mint of the token takes place only if the else if statement is true as it can be seen in Soulmate.sol::mintSoulmateToken():
if (soulmate1 == address(0)) {
idToOwners[nextID][0] = msg.sender;
ownerToId[msg.sender] = nextID;
emit SoulmateIsWaiting(msg.sender);
} else if (soulmate2 == address(0)) {
idToOwners[nextID][1] = msg.sender;
// Once 2 soulmates are reunited, the token is minted
ownerToId[msg.sender] = nextID;
soulmateOf[msg.sender] = soulmate1;
soulmateOf[soulmate1] = msg.sender;
idToCreationTimestamp[nextID] = block.timestamp;
emit SoulmateAreReunited(soulmate1, soulmate2, nextID);
emit SoulmateAreReunited(soulmate1, msg.sender, nextID);
@> _mint(msg.sender, nextID++);
}
Impact: The first soulmate won't receive the NFT.
Proof of Concept: Add the following two lines to SulmateTest.t.sol::test_MintNewToken:
assertTrue(soulmateContract.balanceOf(soulmate1) == 0);
assertTrue(soulmateContract.balanceOf(soulmate2) == 1);
Recommended Mitigation: Place the _mint() function in the first part of the if as well.
Rewards breakdown
nSLOC
233This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.