Funds will be stuck forever For one partner if other partner is blocked by owner or burn its profile.
Description
There is no check in SoulboundProfileNFT::blockProfile() or SoulboundProfileNFT::burnProfile() which checks if the address is already matched or not.
Impact
Funds will be stuck for other partner as there is no other mechanism to rescue funds.
Proof of Concept
Lets take a scenario
Alice and Bob liked eachother's profile
The Multisig wallet is created between them
Now Bob's profile is Blocked by owner.
Here Alice is innocent but her funds are stuck in the multisig as it requires Alice's and Bob's approval to move the funds
Recommended Mitigation
-
A switch like boolean should be used to check if address is already matched before
burnProfile()orblockProfile(). -
Alternatively, emergency funds withdrawl mechanism should be introduced in
MultiSigContract.
Appeal created
finding_blocking_or_burning_no_refund_balances_or_multisig
Likelihood: Low, burning with money in it would be a user mistake, and being blocked is Low. Impact: High, loss of funds
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.