DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Anyone can mint new profile

f3d0ss

Summary

Since SoulboundProfileNFT::mintProfile lacks access restrictions, any user can mint an arbitrary number of profiles without being verified, opening the door for abuse and potential manipulation of the system.

Vulnerability Details

The mintProfile function in the SoulboundProfileNFT contract is implemented without any form of authentication or verification. This means that any Ethereum address can call this function and create profiles without undergoing any identity or eligibility checks.

Impact

  • Attackers can flood the system with fake profiles.

  • The trustworthiness of the platform may be undermined, as the influx of unverified profiles may lead to fraudulent activities or misrepresentation.

  • Core functionality that relies on the assumption of unique, verified profiles might be compromised.

Tools Used

  • Manual Review

  • Foundry

Recommendations

  • Use access control on SoulboundProfileNFT::mintProfile and add a profile address parameter.

-function mintProfile(string memory name, uint8 age, string memory profileImage) external {
+function mintProfile(string memory name, uint8 age, string memory profileImage, address profileAddress) external onlyOwner {
- require(profileToToken[msg.sender] == 0, "Profile already exists");
+ require(profileToToken[profileAddress] == 0, "Profile already exists");
​
uint256 tokenId = ++_nextTokenId;
- _safeMint(msg.sender, tokenId);
+ _safeMint(profileAddress, tokenId);
​
// Store metadata on-chain
_profiles[tokenId] = Profile(name, age, profileImage);
- profileToToken[msg.sender] = tokenId;
+ profileToToken[profileAddress] = tokenId;
​
- emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
+ emit ProfileMinted(profileAddress, tokenId, name, age, profileImage);
}
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

invalid_sybil_attack

Still have to pay to like anyone. No impact.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.