DatingDapp

Summary

In src/SoulboundProfileNFT.sol, the mintProfile function first checks the validity, then mints the NFT, which may trigger an external call via the onERC721Received function, and finally updates the contract's internal state. This violates the Checks-Effects-Interactions (CEI) principle, potentially introducing a reentrancy risk.

Vulnerability Details

The function implementation is as follows:

In this function, _safeMint(msg.sender, tokenId) is executed before updating _profiles[tokenId] and profileToToken[msg.sender]. Since _safeMint can trigger onERC721Received, which allows external contracts to execute arbitrary logic, an attacker could exploit this reentrancy window to manipulate contract state in an unintended way.

Impact

• Potential reentrancy attack, leading to unauthorized multiple profile minting

• Inconsistent contract state if execution is reverted unexpectedly during the external call

Tools Used

Manual code review

Recommendations

Reorder the function logic to follow the CEI principle:

1. Update the contract's internal state before performing any external interactions

2. Call _safeMint only after modifying _profiles[tokenId] and profileToToken[msg.sender]

The corrected implementation should be:

This modification ensures that any external contract interaction occurs only after the contract's internal state is securely updated, reducing the risk of reentrancy attacks.