DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Centralized `blockUser` Function Locks User Funds Without Refund, Leading to Potential Abuse and Loss of Trust

lamassu

Severity

Impact: Medium
Likelihood: Medium
Severity: Medium

Vulnerability Details

The SoulboundProfileNFT::blockUser function deletes a user's profile without refunding any locked funds.

Impact

By introducing this centralized function, a malicious contract owner could arbitrarily block users and lock their funds without any recourse. This could be perceived as an unethical practice, reducing trust in the protocol.

Proof of Concept

The following test demonstrates that a blocked user does not receive any funds back, effectively locking them in the contract:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
​
import "forge-std/Test.sol";
import {MultiSigWallet} from "../src/MultiSig.sol";
import {LikeRegistry} from "../src/LikeRegistry.sol";
import {SoulboundProfileNFT} from "../src/SoulboundProfileNFT.sol";
​
contract LikeRegistryTest is Test {
​
SoulboundProfileNFT profileNFT;
LikeRegistry likeRegistry;
address loveBird1;
address loveBird2;
address owner;
​
function setUp() public {
owner = makeAddr("owner");
loveBird1 = makeAddr("loveBird1");
loveBird2 = makeAddr("loveBird2");
vm.deal(payable(loveBird1), 10 ether);
vm.deal(payable(loveBird2), 10 ether);
}
​
function test_blockUserLocksFunds() public {
vm.startPrank(owner);
profileNFT = new SoulboundProfileNFT();
likeRegistry = new LikeRegistry(address(profileNFT));
vm.stopPrank();
​
vm.prank(loveBird1);
profileNFT.mintProfile("Alice", 25, "ipfs://profileImageAlice");
vm.prank(loveBird2);
profileNFT.mintProfile("Bob", 25, "ipfs://profileImageBob");
​
vm.prank(loveBird1);
likeRegistry.likeUser{value: 1 ether}(loveBird2);
vm.prank(owner);
profileNFT.blockProfile(loveBird1);
​
assertEq(loveBird1.balance, 9 ether); //Never got ether back
assertEq(address(likeRegistry).balance, 1 ether); //Funds locked
}
}

Tools Used

Manual Review

Recommendations

If the protocol is designed to be centralized, blocking an account should be limited to cases where the user violates specific terms and conditions, such as using an inappropriate name or profile picture. Without clear guidelines, arbitrary blocking and fund locking could be perceived as unethical.

Alternatively, a more user-friendly approach would be to implement a slashing mechanism, similar to Ethereum’s penalties for malicious stakers. Instead of locking the full balance, the contract could impose a partial penalty while allowing users to reclaim a portion of their funds.

Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_blocking_or_burning_no_refund_balances_or_multisig

Likelihood: Low, burning with money in it would be a user mistake, and being blocked is Low. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.