DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Block Profile does not block address, so the same address can create same profile again

0x1422

Description

In SoulboundProfileNFT contract blockProfile() function only burns the profile of user and not actually block the address.

Impact

A blocked user can create same profile with same address which makes blocking a profile useless.

Proof of Concept

  • Here we are blocking user as a owner

  • the user is block and her profile is burned

  • But she can mint same profile using same address again

function testSameProfileAfterBlockProfile() public {
// minting soulboundNFT for user
vm.prank(user);
soulboundNFT.mintProfile("Alice", 25, "ipfs://profileImage");
​
uint256 tokenId = soulboundNFT.profileToToken(user);
assertEq(tokenId, 1, "Token should exist before blocking");
​
// burn profile as a owner
vm.prank(owner);
soulboundNFT.blockProfile(user);
​
// profile is burned
uint256 newTokenId = soulboundNFT.profileToToken(user);
assertEq(newTokenId, 0, "Token should be removed after blocking");
​
//mint using same credentials
vm.prank(user);
soulboundNFT.mintProfile("Alice", 25, "ipfs://profileImage");
​
// asserting new profile for same address
uint256 tokenId2 = soulboundNFT.profileToToken(user);
assertEq(tokenId2, 2, "Token should exist before blocking");
}

Recommended Mitigation

In SoulboundProfileNFT contract we need to add a mapping which checks if the address is blocked or not.

And we should check if the address is blocked while minting profile

And for that we need to update mintProfile and blockProfile function.

contract SoulboundProfileNFT is ERC721, Ownable {
// keeping track of blocked addresses
+ mapping(address => bool) public isBlocked;
...
​
function mintProfile(string memory name, uint8 age, string memory profileImage) external {
​
// checking if the user is blocked or not
+ require(isBlocked[msg.sender] != true, "This user is blocked by the owner of DatingApp");
...
}
​
function blockProfile(address blockAddress) external onlyOwner {
// blocking the user, so that user cannot create the profile again.
+ isBlocked[blockAddress] = true;
...
}
}
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_blocked_user_can_recreate_a_profil

Likelihood: Low, any blocked users. Impact: High, not really blocked.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.