DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Reentrancy attack in mintProfile()

bmarouen

Summary

The mintProfile() function uses _safeMint(), which calls the recipient’s address if it's a contract. This can allow an attacker to perform a reentrancy attack, potentially manipulating _nextTokenId to mint multiple NFTs before it updates correctly.

Vulnerability Details

The _safeMint() function triggers the onERC721Received() callback in contracts.
If an attacker creates a malicious contract that re-calls mintProfile() inside onERC721Received(), they can mint multiple NFTs before _nextTokenId updates correctly.
This results in incorrect token indexing and potential duplication of profile NFTs.

Impact

⦁ Multiple NFTs could be assigned to a single user, violating the soulbound nature of the token.
⦁ Attackers could manipulate the token index, breaking the integrity of the contract.

⦁ Could cause inconsistencies in profile mappings, leading to undefined behavior.

Tools Used

Manual review

Recommendations

Update _profiles and profileToToken before minting the nft:

function mintProfile(string memory name, uint8 age, string memory profileImage) external {
require(profileToToken[msg.sender] == 0, "Profile already exists");
​
// an attacker can use a rentrancy to manupulate the index
uint256 tokenId = ++_nextTokenId;
// Store metadata on-chain
_profiles[tokenId] = Profile(name, age, profileImage);
profileToToken[msg.sender] = tokenId;
//minting the NFT
_safeMint(msg.sender, tokenId);
​
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
}
Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_mintProfile_reentrancy

Likelihood: High, anyone can do it. Impact: Low, several profile will be minted, which is not allowed by the protocol, but only the last one will be stored in profileToToken and won't affect `likeUser` or `matchRewards`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.