DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

SoulboundProfileNFT::blockProfile only burns the current NFT held by the user without effectively blocking the user.

riceee

Vulnerability Details

function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");
​
_burn(tokenId);
delete profileToToken[blockAddress];
delete _profiles[tokenId];
​
emit ProfileBurned(blockAddress, tokenId);
}

This is the blockProfile method used by the protocol owner to block a user address. However, all this does is delete the user from the protocol, similar to burnProfile. The user can simply mint a new profile again, making the intended functionality of this function ineffective.

Impact

A blocked user can just create a new profile and continue using the protocol, bypassing the restriction. Which hinders the intended working of the protocol.

Tools Used

Manual Review

Recommendations

To permanently ban a user's address, add a mapping(address => bool) isBlocked; and ensure that mintProfile checks if the address is blocked before allowing minting.

Suggested Fix:

mapping(address => bool) public isBlocked;
​
function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");
​
_burn(tokenId);
delete profileToToken[blockAddress];
delete _profiles[tokenId];
isBlocked[blockAddress] = true; <@
​
emit ProfileBurned(blockAddress, tokenId);
}
​
function mintProfile(string memory name, uint8 age, string memory profileImage) external {
[...]
require(!isBlocked[msg.sender], "You are blocked"); //Add this check
[...]
}

This ensures that once an address is blocked, it can never mint a new profile again.

Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_mintProfile_reentrancy

Likelihood: High, anyone can do it. Impact: Low, several profile will be minted, which is not allowed by the protocol, but only the last one will be stored in profileToToken and won't affect `likeUser` or `matchRewards`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.