Blocking logic has no impact
Summary
The owner of the SoulboundProfileNFTcan block users by calling the blockProfile function. This can be done for users, which don't follow the rules of the protocol.
Under the hood, the function will delete the NFT of the user. However, this has almost no impact on the user. The other parts of the protocol rely heavily on the address of the user (matches, likes, multiSig) and the address is not blocked at all. The malicious user can mint a new NFT with the same characteristics aside from the specific NFT id, which has no impact.
Impact
Medium, as expected functionality is not implemented properly.
Tools Used
Recommendations
Block the user by address and not only removing his NFT or give up the blocking functionality at all.
Appeal created
finding_blocked_user_can_recreate_a_profil
Likelihood: Low, any blocked users. Impact: High, not really blocked.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.