DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

An user can keep burning and re-minting new profiles with new identity and scam other users.

riceee

Vulnerability Details

Currently SoulboundProfileNFT::burnProfile allows an user to burn their profile NFT. Anyone can abuse this feature by burning and re-minting a new profile NFT with different name, age and image parameters.

Let's say an user matched with someone, then they burn their profile and create a new one with different parameters. They can just keep abusing this burnProfile feature to keep minting new fake profiles again and again using the same address.

Impact

The ability to burn and re-mint a new profile NFT with different attributes (name, age, image) allows users to circumvent the soulbound nature of the NFT and exploit the protocol’s matchmaking.
This will lead to genuine users getting scammed into liking fake profiles paying 1 Ether, and later finding out the profiles were fake if it reaches the dating stage, results in an overall dissatisfaction and lack of trust of other users in the protocol.

Tools Used

Manual Review

Recommendations

Maybe keep a mapping of all the addresses to profile info that have minted a profile once using this protocol. And if they try to re-mint after burning using different parameters revert the transaction.

mapping(address user => Profile) userProfile;
​
function mintProfile(string memory name, uint8 age, string memory profileImage) external {
//Add these checks within the mint function
if(userProfile[msg.sender].name != ""){
require(userProfile[msg.sender].name == name, "Cant re-register with a different name");
require(userProfile[msg.sender].profileImage == profileImage, "Cant re-register with a different image");
}
}
Updates

Appeal created

n0kto Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

invalid_burning_recreating_profile

Design choice to update your age, name and photo. Scam is not a valid impact.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.