DatingDapp

Summary

The SoulboundProfileNFT contract allows users to mint profiles with unrealistic or invalid age values (e.g., age = 0 or age = 200). This undermines the protocol’s credibility and could lead to misuse, as the platform is likely intended for adults. Without validation, attackers can create profiles with absurd ages, eroding user trust and violating potential legal requirements.

Vulnerability Details

Location

• Contract: SoulboundProfileNFT.sol

• Function: mintProfile

Root Cause

• The mintProfile function does not validate the age parameter. Users can input any value within the uint8 range (0–255), including invalid ages like 0 or 255.

• Example attack: A user mints a profile with age = 5, which is clearly unrealistic for a dating platform.

Code Snippet

Impact

Severity: Low-Medium

• Credibility Risk: The protocol may be seen as unserious or unsafe if fake profiles with absurd ages proliferate.

• Legal Risk: If the platform is intended for adults (18+), allowing underage profiles could violate regulations.

• User Experience: Genuine users may avoid the platform if they encounter obviously fake profiles.

Recommended Mitigation

Fix: Add Age Validation

Enforce a minimum age requirement (e.g., 18) in the mintProfile function:

Additional Recommendations

1. Upper Bound Check:
   Consider adding a reasonable upper limit (e.g., age <= 120) to prevent unrealistic values:

   require(age <= 120, "Age must be realistic");

2. Configurable Age Range:
   Store minimum and maximum age values in mutable variables (e.g., controlled by governance) for flexibility.