DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

[G-3] Redundant ownership check in `SoulboundProfileNFT::burnProfile` wastes gas

oks_oks

Description: In SoulboundProfileNFT.sol, the burnProfile function performs two checks that verify the same condition. The second check ownerOf(tokenId) == msg.sender is redundant because the profileToToken mapping already ensures ownership.

function burnProfile() external {
uint256 tokenId = profileToToken[msg.sender];
require(tokenId != 0, "No profile found");
// Redundant check - wastes gas
@> require(ownerOf(tokenId) == msg.sender, "Not profile owner");
}

This is redundant because:

  1. profileToToken[msg.sender] only contains tokens that belong to their respective owners

  2. If a user has a token in this mapping, they are definitely the owner

  3. There's no way for a token to exist in profileToToken mapping with a different owner

Impact:

  • Unnecessary ownerOf call costs extra gas

  • Every profile burn operation costs more gas than necessary

Proof of Concept:
The following scenarios all lead to the same result with or without the second check:

  1. If user has no profile: First require fails

  2. If user has profile: First require passes and ownership is already guaranteed

  3. If token exists but user isn't owner: Impossible scenario due to profileToToken mapping design

Recommended Mitigation: Remove the redundant ownership check:

function burnProfile() external {
uint256 tokenId = profileToToken[msg.sender];
require(tokenId != 0, "No profile found");
- require(ownerOf(tokenId) == msg.sender, "Not profile owner");
// Continue with burn logic
}
Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.