DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Possibility of Sybil Attack in the `SoulboundProfileNFT::mintProfile` making it possible to get more matches than expected

roccomania

Summary

The SoulboundProfileNFT::mintProfile function allows users to mint a profile NFT for free without any restrictions, enabling potential Sybil attacks.

Vulnerability Details

A Sybil attack occurs when a single user creates multiple profiles to gain an unfair advantage. Since the mintProfile function does not impose any costs or restrictions, a malicious user could create multiple profiles by using different addresses. A user can create multiple profiles and use it to receive Ethers from innocent users of the protocol thinking they are different users, whereas, those recipient profiles are from same user trying to benefit from unsuspecting users. He can receive Ethers to all profiles and match them to himself using other spam profiles to fulfil the matching.

function mintProfile(string memory name, uint8 age, string memory profileImage) external {
require(profileToToken[msg.sender] == 0, "Profile already exists");
​
uint256 tokenId = ++_nextTokenId;
_safeMint(msg.sender, tokenId);
​
// Store metadata on-chain
_profiles[tokenId] = Profile(name, age, profileImage);
profileToToken[msg.sender] = tokenId;
​
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
}

Impact

  • Unfair advantage for malicious users.

  • Degradation of the protocol's integrity and trustworthiness.

  • Attacker has nothing to lose apart from 10% fee which will be removed by earnings from unsuspecting users since he owns both accounts that gets matched.

Tools Used

  • Manual code review.

Recommendations

Although this cannot be fully fixed but can be greatly reduced if not free. Consider implementing minting fee to mint a profile NFT.

+ uint256 public constant MINT_FEE = 0.01 ether;
​
function mintProfile(string memory name, uint8 age, string memory profileImage) external payable {
+ require(msg.value >= MINT_FEE, "Insufficient minting fee");
require(profileToToken[msg.sender] == 0, "Profile already exists");
​
uint256 tokenId = ++_nextTokenId;
_safeMint(msg.sender, tokenId);
​
_profiles[tokenId] = Profile(name, age, profileImage);
profileToToken[msg.sender] = tokenId;
​
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
}
Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_sybil_attack

Still have to pay to like anyone. No impact.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.