DatingDapp

Description:
The project scope does not provide a deployment script, leaving the responsibility of deploying critical contracts to the protocol deployer. If the deployer forgets to deploy the LikeRegistry.sol contract, a malicious user could deploy it first, making themselves the contract owner and gaining control over critical functions. This exposes the protocol to unauthorized fee withdrawals and potential fund theft.

Impact:
The impact is high, as an attacker could deploy the LikeRegistry contract before the legitimate deployer and become the owner. This would allow the attacker to withdraw all accumulated fees using the withdrawFees() function. The application’s revenue model would be compromised, leading to financial losses for the protocol.

The likelihood is medium. We are assuming that the script might fail to deploy the LikeRegistry.sol contract. This assumption is based on the fact that in the test file, the protocol developer has not initialized this contract, making us think that they might also forget to include it in the deployment script. This scenario would only occur if the deployer forgets to include it.

Proof of Concept:

1. The LikeRegistry contract does not enforce an ownership restriction on deployment.

2. Any user can deploy the contract using:

   LikeRegistry maliciousRegistry = new LikeRegistry(address(_profileNFT));

```javascript

contract SoulboundProfileNFTTest is Test {
SoulboundProfileNFT soulboundNFT;
LikeRegistry likeRegistry;
address user = address(0x123);
address user2 = address(0x456);
address owner = address(this); // Test contract acts as the owner

function setUp() public {
    soulboundNFT = new SoulboundProfileNFT();

    vm.deal(user, 100 ether);
    vm.deal(user2, 100 ether);
}
function test__audit__userGainsOwnershipOfLikeRegistry() public {
    vm.prank(user); // Simulates user calling the function
    soulboundNFT.mintProfile("Alice", 25, "ipfs://profileImage");
    vm.prank(user2); // Simulates user calling the function
    soulboundNFT.mintProfile("David", 26, "ipfs://profileImage");

    vm.prank(user);
    LikeRegistry likeRegistryOwnedByUser = new LikeRegistry(
        address(soulboundNFT)
    );

    vm.expectRevert();
    likeRegistryOwnedByUser.withdrawFees();

    vm.prank(user);
    likeRegistryOwnedByUser.withdrawFees();
}
}

```

Recommended Mitigation:
Please don't forget to deploy LikeRegistry.sol immediately after deploying SoulboundProfileNFT.sol.