DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Possible reentrancy in method mintProfile

mnedelchev_

Summary

Possible reentrancy in method mintProfile inside contract SoulboundProfileNFT.

Vulnerability Details

function testAttackMint() public {
soulboundNFT.mintProfile("Some Name", 22, "XYZ");
}
​
function onERC721Received(address, address, uint256, bytes calldata) external returns (bytes4) {
if (counter < 100) {
counter+=1;
testAttackMint(); // Reenter testAttackMint
}
return IERC721Receiver.onERC721Received.selector;
}

Impact

  1. Abuse spam minting of SoulboundProfileNFT NFTs thus the NFT collection loses its uniqueness.

  2. Spamming mapping(uint256 => Profile) private _profiles; with metadata which also results in method tokenURI to return metadata also for the NFTs which were being minted in the reentrancy.

  3. Spamming emitting event ProfileMinted thus confusing off-chain dApps.

Recommendations

  1. Inherit ReentrancyGuard and add the nonReentrant modifier to method mintProfile

  2. OR apply the checks-effects-interactions pattern:

function mintProfile(string memory name, uint8 age, string memory profileImage) external {
require(profileToToken[msg.sender] == 0, "Profile already exists");
​
uint256 tokenId = ++_nextTokenId;
​
// Store metadata on-chain
_profiles[tokenId] = Profile(name, age, profileImage);
profileToToken[msg.sender] = tokenId;
​
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
_safeMint(msg.sender, tokenId); // Place _safeMint here
}
Updates

Appeal created

n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_mintProfile_reentrancy

Likelihood: High, anyone can do it. Impact: Low, several profile will be minted, which is not allowed by the protocol, but only the last one will be stored in profileToToken and won't affect `likeUser` or `matchRewards`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.