Blocked users can join the Dapp again using the same address
Summary
Blocked users can join the Dapp again using the same address as if they chose to delete their account. They should be blacklisted and prevented from registering again.
Vulnerability Details
Consider this scenario:
A is blocked by the owner
A joins again by calling
mintProfile(...)again with the exact same params as before
Impact
A was obviously blocked for a good reason since the owner is trusted, A will keep on misbehaving on the Dapp
Tools Used
Manual Review
Recommendations
Implement a blacklisting mechanism to prevent blocked users from joining the Dapp again
Appeal created
finding_blocked_user_can_recreate_a_profil
Likelihood: Low, any blocked users. Impact: High, not really blocked.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.