Submission Details
Severity:
Wrong event emitted by `SoulboundProfileNFT::blockProfile` is misleading for event indexing protocol or external use.
**Description:** If a profile is blocked, the `ProfileBurned` event is emitted by the function `SoulboundProfileNFT::blockProfile`. The `ProfileBurned` event is already used by the function `SoulboundProfileNFT::burnProfile`, which could be misleading.
**Impact:** Any event indexing protocol (like The Graph) would be misled by the event and think a profile was burned, while it was blocked.
**Proof of Concept:** The following prove that the `ProfileBurned` event is emitted with the `blockProfile` function.
Add the following code at the end of `testSoulboundProfileNFT.t.sol` :
```javascript
function testEmitWrongEvent() public {
// mint user profile
vm.prank(user);
soulboundNFT.mintProfile("Alice", 25, "ipfs://profileImage");
uint256 tokenId = soulboundNFT.profileToToken(user);
// make owner block user but burn event is emitted
vm.prank(owner);
vm.expectEmit(true, false, false, false, address(soulboundNFT));
emit ProfileBurned(address(user), tokenId);
soulboundNFT.blockProfile(user);
}
```
**Recommended Mitigation:**
- Create a new `ProfileBlocked` event
- Adapt the event in `SoulboundProfileNFT::blockProfile`
```diff
contract SoulboundProfileNFT is ERC721, Ownable {
...
+ event ProfileBlocked(address indexed user, uint256 tokenId);
...
function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");
_burn(tokenId);
delete profileToToken[blockAddress];
delete _profiles[tokenId];
- emit ProfileBurned(blockAddress, tokenId);
+ emit ProfileBlocked(blockAddress, tokenId);
}
}
```
Updates
Appeal created
n0kto 5 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Rewards breakdown
nSLOC
197This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.