DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

SoulboundProfileNFT: Parameters are not validated

alekseyts

[Low] SoulboundProfileNFT: Parameters are not validated

Profile creation lacks age validation, no name length and profileImage length validation

Impact: Potential regulatory issues for age..

Proof of Concept:

function mintProfile(string memory name, uint8 age, string memory profileImage) external {
// No age validation
}

Recommended Mitigation: Add age validation:

require(age >= 18, "Must be 18 or older");
require(age <= 100, "Invalid age");
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_URI_injection_scam_underaged_bad_name_photo_etc

Scamming/phishing is not the protocol problem, that's a user mistake. NFT are unique, even if someone does a copy of your profile (which is also possible in web2), I consider it informational. Injection is a problem for the web2 part of the protocol, not a bug here. For the age, it depends on the countries law and future medicine. Anyways, that's more an ethical/political problem, not a bug.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.