DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

blockProfile in SoulboundProfileNFT.sol Allows Profile Recreation

dsbex

Summary

The SoulboundProfileNFT::blockProfile function does not implement a mapping to permanently block an address from creating a new profile. As a result, a blocked user can simply create a new profile after being "blocked," rendering the function ineffective.

Vulnerability Details

The function blockProfile removes a user's profile by burning their token and deleting their associated data.
However, it does not store any record that the address was blocked. There is no mapping to check if a user is blocked and cannot create profiles anymore. So after a user is blocked he can call SoulboundProfileNFT::mintProfile function and create a new profile which makes the blockProfile function useless.

Impact

  • Blocked users can recreate profiles without restriction.

  • No permanent ban mechanism, making it impossible to enforce user bans.

  • Potential for abuse if malicious users repeatedly exploit the system.

Tools Used

  • Manual review

  • Foundry tests

Recommendations

  • Introduce a mapping

mapping(address => bool) public isBlocked;

Modify blockProfile to set isBlocked[blockAddress] = true;

Add a if (!isBlocked[msg.sender]) revert AddressIsBlocked(); check in mintProfile.

Consider implementing an appeal/unblock mechanism if needed.

The correct version of the function:

function blockProfile(address blockAddress) external onlyOwner {
require(!isBlocked[blockAddress], "Address already blocked");
​
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");
​
_burn(tokenId);
delete profileToToken[blockAddress];
delete _profiles[tokenId];
​
isBlocked[blockAddress] = true; // Mark address as blocked
​
emit ProfileBurned(blockAddress, tokenId);
}
Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_blocked_user_can_recreate_a_profil

Likelihood: Low, any blocked users. Impact: High, not really blocked.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.