Submission Details
Severity:
Lack of Age Verification and Restriction
Summary
There's no mechanism to verify the age of the user or to restrict minting for inappropriate ages (like zero or negative). This could lead to minors or bots creating profiles.
Vulnerability Details
### PoC
Deploy the SoulboundProfileNFT contract.
As a user with address 0x123, call mintProfile with an invalid age (e.g., 0 or 1000):
solidity
soulboundNFT.mintProfile("Baby", 0, "ipfs://baby");
Verify that the NFT is minted successfully despite the age being implausible.
PoC Code:
```solidity
function testMintWithInvalidAge() public {
address user = address(0x123);
vm.deal(user, 1 ether);
vm.prank(user);
soulboundNFT.mintProfile("Baby", 0, "ipfs://baby");
// Check if the profile was minted
uint256 tokenId = soulboundNFT.profileToToken(user);
assertNotEq(tokenId, 0, "Profile should have been minted with invalid age");
}
```
Explanation:
This PoC demonstrates that the contract does not restrict or verify the age input, allowing the minting of profiles with clearly invalid ages (like 0).
The lack of age validation could lead to issues with compliance, user authenticity, and platform integrity, especially in contexts where age verification is required by law or for safety reasons.
Impact
Without age verification, the platform might not comply with legal age requirements, exposing it to legal risks or allowing underage users into an adult platform.
Tools Used
Manual Review
Recommendations
Integrate an off-chain verification process or implement smart contract logic to ensure a minimum age requirement. Consider using zero-knowledge proofs or other cryptographic methods for privacy-preserving age verification.
Updates
Appeal created
n0kto 6 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
invalid_URI_injection_scam_underaged_bad_name_photo_etc
Scamming/phishing is not the protocol problem, that's a user mistake. NFT are unique, even if someone does a copy of your profile (which is also possible in web2), I consider it informational. Injection is a problem for the web2 part of the protocol, not a bug here. For the age, it depends on the countries law and future medicine. Anyways, that's more an ethical/political problem, not a bug.
Rewards breakdown
nSLOC
197This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.