The burnProfile function will lock user's ETH
Summary
Each user can call SoulboundProfileNFT::burnProfileonce he no longer wants to participate in the protocol.
However, calling this function will not fully reset his state. It will delete his NFT, but the ETH, which the user spent for likes in the protocol will not be returned. In addition to that, not having an active NFT, will prevent other users to like him back. This makes his ETH stuck in the contract forever. Leaving the code like this will lead to only bad consequences for the user, which makes this function useless.
Impact
Medium, as expected behaviour is not implemented properly
Tools Used
Manual review
Recommendations
While deleting the NFT, also remove the likes of the user and return him the ETH.
Appeal created
finding_blocking_or_burning_no_refund_balances_or_multisig
Likelihood: Low, burning with money in it would be a user mistake, and being blocked is Low. Impact: High, loss of funds
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.