DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Profile Impersonation Via Duplicate Parameters in SoulboundProfileNFT Contract

0xblackadam

Description:

The SoulboundProfileNFT contract's mintProfile function lacks validation to check if profile parameters already exist, allowing malicious users to impersonate others. This is particularly severe in a dating context because:

  • Attackers can create profiles with identical names, ages, and images as existing users

  • Combined with vanity addresses (similar looking addresses), this enables sophisticated impersonation

  • No uniqueness checks on profile data allows multiple copies of the same identity

Impact:

  • Identity theft and impersonation of popular profiles

  • Users can be scammed by believing they're interacting with legitimate profiles

  • Loss of trust in the platform's verification system

  • Potential for social engineering attacks

  • Emotional and financial harm to users who fall victim to impersonators

Lines of code:

()

Proof of Concept

function testProfileImpersonation() public {
// Original user creates profile
address realUser = address(0x1234);
vm.prank(realUser);
soulboundNFT.mintProfile("Alice", 25, "ipfs://real_alice_photo");
// Attacker creates identical profile with similar address
// Note: In reality, attacker would generate vanity address similar to realUser
address attackerAddress = address(0x1235); // Similar looking address
vm.prank(attackerAddress);
// Can create exactly the same profile
soulboundNFT.mintProfile("Alice", 25, "ipfs://real_alice_photo");
// Both profiles exist with identical data
uint256 realUserTokenId = soulboundNFT.profileToToken(realUser);
uint256 attackerTokenId = soulboundNFT.profileToToken(attackerAddress);
// Both return same metadata in tokenURI
string memory realURI = soulboundNFT.tokenURI(realUserTokenId);
string memory fakeURI = soulboundNFT.tokenURI(attackerTokenId);
// URIs will contain identical profile data
​
assertEq(realURI, fakeURI, "Both profiles should have same token uri");
}

  • Vanity address Generator: ()

  • article by Certik on Vanity address: ()

Recommended Mitigation Steps

  • Add mappings to track used names and images by hashing them

  • Add verified badge for confirmed identities

  • Add reporting system for impersonators

  • Implement profile verification system

These changes help prevent identity theft by:

  • Ensuring profile uniqueness

  • Making impersonation more difficult

  • Providing ways to verify legitimate users

  • Enabling the community to report fake profiles

Tools Used

Manual Review + Foundry Testing Framework

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

invalid_URI_injection_scam_underaged_bad_name_photo_etc

Scamming/phishing is not the protocol problem, that's a user mistake. NFT are unique, even if someone does a copy of your profile (which is also possible in web2), I consider it informational. Injection is a problem for the web2 part of the protocol, not a bug here. For the age, it depends on the countries law and future medicine. Anyways, that's more an ethical/political problem, not a bug.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.