DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Inadequate User Blocking Allows Profile Recreation After Deletion

lamassu

Severity

Impact: Medium
Likelihood: High
Severity: Medium

Vulnerability Details

The SoulboundProfileNFT::blockUser function does not effectively block a user from the platform. Instead of preventing further interaction, it merely deletes the existing profile, allowing the user to mint a new one. As a result, the intended blocking mechanism fails to achieve its purpose.

Impact

A malicious user who creates an offensive name or profile picture can simply recreate their profile with the same details after being "blocked." This undermines moderation efforts and allows repeated abuse.

Proof of Concept

The following test case demonstrates that a blocked user can easily mint a new profile with identical information:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
​
import "forge-std/Test.sol";
import {MultiSigWallet} from "../src/MultiSig.sol";
import {LikeRegistry} from "../src/LikeRegistry.sol";
import {SoulboundProfileNFT} from "../src/SoulboundProfileNFT.sol";
​
contract LikeRegistryTest is Test {
​
SoulboundProfileNFT profileNFT;
LikeRegistry likeRegistry;
address loveBird1;
address loveBird2;
address owner;
​
function setUp() public {
owner = makeAddr("owner");
loveBird1 = makeAddr("loveBird1");
loveBird2 = makeAddr("loveBird2");
vm.deal(payable(loveBird1), 10 ether);
vm.deal(payable(loveBird2), 10 ether);
}
​
function test_blockUserDoesntBlock() public {
vm.startPrank(owner);
profileNFT = new SoulboundProfileNFT();
likeRegistry = new LikeRegistry(address(profileNFT));
vm.stopPrank();
​
vm.prank(loveBird1);
profileNFT.mintProfile("Alice", 25, "ipfs://profileImageAlice");
vm.prank(owner);
profileNFT.blockProfile(loveBird1);
assertEq(profileNFT.profileToToken(loveBird1), 0); //Profile doesn't exist anymore
vm.prank(loveBird1);
profileNFT.mintProfile("Alice", 25, "ipfs://profileImageAlice");
assertNotEq(profileNFT.profileToToken(loveBird1), 0); //Same profile recreated
}
}

Tools Used

Manual Review

Recommendations

To properly enforce user blocking, consider implementing a blockedUsers mapping that prevents a blocked address from minting a new profile. However, this alone does not prevent the same user from bypassing the block by using a different address.

For a more robust solution, integrating Know Your Customer (KYC) verification could help enforce persistent bans.

Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_blocked_user_can_recreate_a_profil

Likelihood: Low, any blocked users. Impact: High, not really blocked.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.