DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Soulbound Restriction Bypass via approve()

bmarouen

Summary

Although transfer functions are blocked, users can still call approve() to grant transfer rights to another address. This indirectly allows transfers, bypassing the soulbound restriction.

Vulnerability Details

  • Users can approve another address to move their NFT, allowing indirect transfers.

  • The contract overrides transferFrom() and safeTransferFrom() but does not block approve().

  • This violates the core principle of a soulbound token.

Impact

Users can sell or transfer their soulbound NFT through an intermediary, breaking the contract’s core logic.

Could lead to unauthorized transfers if approvals are exploited.

Tools Used

Manual code review

Recommendations

Override approve() and setApprovalForAll() to prevent any form of token approval:

function approve(address, uint256) public pure override {
revert SoulboundTokenCannotBeTransferred();
}
​
function setApprovalForAll(address, bool) public pure override {
revert SoulboundTokenCannotBeTransferred();
}
​
Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.