Submission Details
Severity:
Missing Like/Matches History Cleanup on Profile Deletion
Summary
When users delete (burn) their dating profiles, their likes and matches stay in the system, causing problems because this left-over data creates confusion in the platform.
Vulnerability Details
The mappings of the LikeRegistry contrct retain data even after profile burns.
contract SoulboundProfileNFT {
function burnProfile() external {
uint256 tokenId = profileToToken[msg.sender];
require(tokenId != 0, "No profile found");
require(ownerOf(tokenId) == msg.sender, "Not profile owner");
_burn(tokenId);
delete profileToToken[msg.sender];
delete _profiles[tokenId];
// Like/Match history not cleared from LikeRegistry
emit ProfileBurned(msg.sender, tokenId);
}
}
contract LikeRegistry {
mapping(address => mapping(address => bool)) public likes;
mapping(address => address[]) public matches;
// These mappings retain data even after profile burns
}
Impact
ETH locked in invalid matches
Misleading platform statistics
Users see matches with burned profiles
Storage bloat from unwanted data
Recommendations
// In LikeRegistry
contract LikeRegistry {
SoulboundProfileNFT public profileNFT;
event LikeHistoryCleared(address indexed user);
event MatchCleared(address indexed user1, address indexed user2);
function clearProfileHistory(address burnedProfile) external {
require(msg.sender == address(profileNFT), "Only NFT contract");
// Clear all likes given by burned profile
for(uint i = 0; i < matches[burnedProfile].length; i++) {
address likedUser = matches[burnedProfile][i];
likes[burnedProfile][likedUser] = false;
// If there was a match, clear it for both users
if(likes[likedUser][burnedProfile]) {
likes[likedUser][burnedProfile] = false;
removeFromMatches(burnedProfile, likedUser);
removeFromMatches(likedUser, burnedProfile);
emit MatchCleared(burnedProfile, likedUser);
}
}
// Clear matches array
delete matches[burnedProfile];
emit LikeHistoryCleared(burnedProfile);
}
function removeFromMatches(address user1, address user2) internal {
address[] storage userMatches = matches[user1];
for(uint i = 0; i < userMatches.length; i++) {
if(userMatches[i] == user2) {
userMatches[i] = userMatches[userMatches.length - 1];
userMatches.pop();
break;
}
}
}
}
// In SoulboundProfileNFT
contract SoulboundProfileNFT {
function burnProfile() external {
uint256 tokenId = profileToToken[msg.sender];
require(tokenId != 0, "No profile found");
require(ownerOf(tokenId) == msg.sender, "Not profile owner");
// Clear like/match history first
likeRegistry.clearProfileHistory(msg.sender);
// Then burn profile
_burn(tokenId);
delete profileToToken[msg.sender];
delete _profiles[tokenId];
emit ProfileBurned(msg.sender, tokenId);
}
}
Updates
Appeal created
n0kto 6 months ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
invalid_burning_recreating_profile
Design choice to update your age, name and photo. Scam is not a valid impact.
Rewards breakdown
nSLOC
197This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.