DatingDapp

Summary

The SoulboundProfileNFT::mintProfile function is vulnerable to a reentrancy attack, which could allow a malicious actor to create multiple profiles by reentering the function before profileToToken[msg.sender] is updated.

Vulnerability Details

The contract doesn't follow CEI(checks, effects, interactions). The function checks whether profileToToken[msg.sender] == 0 before proceeding. _safeMint(msg.sender, tokenId); is called before updating profileToToken[msg.sender].
If the _safeMint function triggers an external call, an attacker could reenter the mintProfile function before profileToToken[msg.sender] is updated.
Since profileToToken[msg.sender] remains 0 during reentrancy, the attacker can call mintProfile multiple times, creating multiple profiles.
Here is what a malicious actor would do:

After we run this code, this is the output:

Which means malicious actor has succesfully created more than 1 profile

Impact

An attacker could bypass the one-profile-per-address restriction.
This could lead to an attacker unfairly obtaining multiple identities in a system designed to restrict each user to a single profile.
The exploit could be used for Sybil attacks, spam, or other manipulations in applications relying on unique profiles.

Tools Used

• Manual review

• Foundry

Recommendations

• Use the Checks-Effects-Interactions Pattern: Move profileToToken[msg.sender] = tokenId; before _safeMint to prevent reentrancy.

• Use Reentrancy Guards: Add nonReentrant from OpenZeppelin's ReentrancyGuard to prevent multiple executions.