DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Reentrancy Risk in mintProfile Function

bryanconquer

Summary

The mintProfile function calls _safeMint(msg.sender, tokenId); before updating the contract's state. Since _safeMint is an ERC721 function, it invokes the onERC721Received function if msg.sender is a smart contract. A malicious contract could exploit this by reentering mintProfile and minting multiple profiles before the first transaction completes.

Vulnerability Details

Deploy the smart contract.

  • A malicious contract calls mintProfile(), which triggers _safeMint().

  • _safeMint() checks if the recipient is a smart contract and calls onERC721Received.

  • The attacker's contract executes a reentrant call to mintProfile().

  • Since profileToToken[msg.sender] has not been updated yet, the attacker bypasses the duplicate profile check and mints multiple profiles.

Impact

_safeMint() is called before updating state, allowing a reentrant call to mint multiple profiles.

Tools Used

manual review

Recommendations

Reorder state updates before _safeMint()

function mintProfile(string memory name, uint8 age, string memory profileImage) external {
require(profileToToken[msg.sender] == 0, "Profile already exists");
​
uint256 tokenId = ++_nextTokenId;
​
// ✅ Update state before calling _safeMint()
profileToToken[msg.sender] = tokenId;
_profiles[tokenId] = Profile(name, age, profileImage);
​
_safeMint(msg.sender, tokenId);
​
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
}
​
​
Use OpenZeppelin’s ReentrancyGuard for extra protection
Updates

Appeal created

n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_mintProfile_reentrancy

Likelihood: High, anyone can do it. Impact: Low, several profile will be minted, which is not allowed by the protocol, but only the last one will be stored in profileToToken and won't affect `likeUser` or `matchRewards`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.