DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

The `LikeRegistry` contract is initialized with an arbitrary address for `SoulboundProfileNFT`

sparrowblck

[M-3] Summary

The LikeRegistry contract is initialized with an arbitrary address for SoulboundProfileNFT.

Vulnerability Details

This allows the owner of the contract to use a malicious counterpart of the shared SoulboundProfileNFT contract, with which they can manipulate the NFT. For example, they can transfer ownership of tokenIds, i.e. stealing profiles.

contract MaliciousSoulboundProfileNFT is ERC721, Ownable {
// ... same implementation as SoulboundProfileNFT ...
​
function transferFrom(address from, address to, uint256 tokenId) public override onlyOwner {
super.transferFrom(from, to, tokenId);
}
​
// ...
}

Impact

Medium impact - no direct stealing of funds can occur, but this still breaks one of the promises of the contract. Low likelihood - the decompiled source code is publically available, so the contents of the SoulboundProfileNFT contract can be verified.

Tools Used

Manual review.

Recommendations

The SoulboundProfileNFT contract can be created in the constructor of the LikeRegistry contract, to ensure that the same contract is used:

// LikeRegistry.sol
- constructor(address _profileNFT) Ownable(msg.sender) {
- profileNFT = SoulboundProfileNFT(_profileNFT);
+ constructor() Ownable(msg.sender) {
+ profileNFT = new SoulboundProfileNFT(msg.sender);
}
}
​
// SoulboundProfileNFT.sol
- constructor() ERC721("DatingDapp", "DTN") Ownable(msg.sender) {}
+ constructor(address _owner) ERC721("DatingDapp", "DTN") Ownable(_owner) {}
Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Admin is trusted

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.