DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Zero-Address Validation

petesol

Summary

Several functions across the contracts lack zero-address validation, potentially leading to locked funds or unusable profiles.

Vulnerability Details

Examples of missing validations:

// In LikeRegistry
function likeUser(address liked) external payable {
// Missing zero-address check for 'liked'
require(msg.value >= 1 ether, "Must send at least 1 ETH");
...
}
​
// In SoulboundProfileNFT
function mintProfile(string memory name, uint8 age, string memory profileImage) external {
// Missing validation for empty strings
require(profileToToken[msg.sender] == 0, "Profile already exists");
...
}

Impact

  • Potential for users to like address(0)

  • Possibility of creating profiles with empty/invalid data

  • Risk of burning tokens to address(0)

Tools Used

  • MythX and custom Semgrep rules were effective in finding missing validations

Recommendations

  1. Add zero-address validation:

function likeUser(address liked) external payable {
require(liked != address(0), "Cannot like zero address");
require(msg.value >= 1 ether, "Must send at least 1 ETH");
...
}

2. Add string validation in mintProfile:

function mintProfile(string memory name, uint8 age, string memory profileImage) external {
require(bytes(name).length > 0, "Name cannot be empty");
require(bytes(profileImage).length > 0, "Profile image cannot be empty");
require(age >= 18 && age <= 100, "Invalid age");
...
}

3. Consider implementing a library for common validation functions

Updates

Appeal created

n0kto Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Users mistake, only impacting themselves.

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.