DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

[H-1] The mintProfile function in SoulboundProfileNFT is vulnerable to a reentrancy attack, allowing an attacker to mint multiple NFTs illegitimately

ananthrajad

Summary

In function SoulboundProfileNFT::mintProfile there is an external call to mint the nft and once user successfully mints an NFT the update to mappings happens -this line in the code- _safeMint(msg.sender, tokenId); .The attacker's contract (MaliciousContract) executes onERC721Received(), which calls mintProfile() again before state is updated.The attacker repeats minting multiple NFTs before the original function finishes.

Vulnerability Details

Below is the code, if you analyse update profileToToken[msg.sender] = tokenId; should happen before the profile mints _safeMint(msg.sender, tokenId); an NFT

#codeblock
function mintProfile(string memory name, uint8 age, string memory profileImage) external {
require(profileToToken[msg.sender] == 0, "Profile already exists");
​
uint256 tokenId = ++_nextTokenId;
_safeMint(msg.sender, tokenId);
// Store metadata on-chain
_profiles[tokenId] = Profile(name, age, profileImage);
profileToToken[msg.sender] = tokenId;
_safeMint(msg.sender, tokenId);
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
}

Impact

Multiple NFTs can be minted by a single profile which voilates the promise of one NFT mint per profile.

Tools Used

Recommendations

Following CEI Pattern (Check-Effects-Interactions) would be able to restrict the attack.
In function SoulboundProfileNFT::mintProfile,making changes as mentioned below:

#codeblock
// ✅ Update state first (Prevents reentrancy)
profileToToken[msg.sender] = tokenId;
_profiles[tokenId] = Profile(name, age, profileImage);
// ✅ Only then call `_safeMint()`
_safeMint(msg.sender, tokenId);
​
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_mintProfile_reentrancy

Likelihood: High, anyone can do it. Impact: Low, several profile will be minted, which is not allowed by the protocol, but only the last one will be stored in profileToToken and won't affect `likeUser` or `matchRewards`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.