DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Input Validation in mintProfile() in SoulBondProfileNFT.sol

ubaidch

Summary

The mintProfile function in SoulBondProfileNFT.sol does not validate the inputs for name, age, and profileImage. This could lead to:

  • Empty or invalid name values.

  • Invalid age values (e.g., 0 or unrealistic values like 200).

  • Malformed or non-existent profileImage URLs.

Impact

  • Users can mint profiles with invalid or nonsensical data.

  • The contract may store garbage data on-chain, wasting gas and storage.

Recommendations

add validation for name ,age and profileImage:

require(bytes(name).length > 0, "Name cannot be empty");
require(age > 0 && age < 150, "Invalid age");
require(bytes(profileImage).length > 0, "Profile image URL cannot be empty");

the update function will look like this:

function mintProfile(string memory name, uint8 age, string memory profileImage) external {
​
​
// Ensure the sender is not the zero address
​
require(msg.sender != address(0), "Sender cannot be the zero address");
​
// Validate inputs
require(bytes(name).length > 0, "Name cannot be empty");
require(age > 0 && age < 150, "Invalid age");
require(bytes(profileImage).length > 0, "Profile image URL cannot be empty");
​
// Ensure the user does not already have a profile
require(profileToToken[msg.sender] == 0, "Profile already exists");
​
// Increment token ID and mint the NFT
uint256 tokenId = ++_nextTokenId;
_safeMint(msg.sender, tokenId);
​
// Store metadata on-chain
_profiles[tokenId] = Profile(name, age, profileImage);
profileToToken[msg.sender] = tokenId;
​
// Emit an event for the minted profile
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage)
}
Updates

Appeal created

n0kto Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Users mistake, only impacting themselves.

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.