DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Unrestricted Age Parameter in `SoulboundProfileNFT::mintProfile()` function

mishraji874

Description: No validation for age range in mintProfile(), allowing potentially inappropriate age entries

Impact: Potential misuse of profile creation process

Proof of Concept:

function exploit_AgeValidation() external {
// Bypass age restrictions by minting with extreme age values
soulboundNFT.mintProfile("Hacker", 255, "malicious-uri"); // Max uint8 value
soulboundNFT.mintProfile("Minor", 0, "exploit-uri"); // Unrestricted age
}

Recommended Mitigation:

  • Add age range validation

  • Implement minimum/maximum age checks

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_URI_injection_scam_underaged_bad_name_photo_etc

Scamming/phishing is not the protocol problem, that's a user mistake. NFT are unique, even if someone does a copy of your profile (which is also possible in web2), I consider it informational. Injection is a problem for the web2 part of the protocol, not a bug here. For the age, it depends on the countries law and future medicine. Anyways, that's more an ethical/political problem, not a bug.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.