DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

In contract `SoulboundProfileNFT`, `mintProfile()` function lets users to mint any profile Image which leads to Identity Theft

0x1422

Description:

A malicious user can mint similar profiles multiple times making it difficult to build genuine connection.

In contract SoulboundProfileNFT, the function mintProfile() lets anyone to mint their profile without checking if the profile Image is used or not.

Which can lead to Identity Theft for original user.

Impact:

The protocol's goal is to make sure that every connection build is genuine and meaningful commitment.

But due to possibility of Identity Theft, the goal cannot be fulfilled every time.

It can also damages the reputation of protocol.

Proof of Concept:

We are trying to mint same profile with different addresses to demonstrate Identity Theft.

function testIdentityTheft() public {
// minting profile for user
vm.prank(user);
soulboundNFT.mintProfile("Alice", 25, "ipfs://profileImage");
​
// minting profile for user2 using same credential as "user"
vm.prank(user2);
soulboundNFT.mintProfile("Alice", 25, "ipfs://profileImage");
​
// getting and asserting token Id for user
uint256 tokenId = soulboundNFT.profileToToken(user);
assertEq(tokenId, 1, "Token should exist before blocking");
​
// getting and asserting token Id for user2
uint256 tokenId2 = soulboundNFT.profileToToken(user2);
assertEq(tokenId2, 2, "Token should exist before blocking");
​
// Token uri for user
string memory tokenUri = soulboundNFT.tokenURI(1);
​
// Token uri for user2
string memory tokenUri2 = soulboundNFT.tokenURI(2);
​
// asserting if tokenUri == tokenUri2
assertEq(tokenUri, tokenUri2);
}

Recommended Mitigation:

Here we are adding a mapping profileTracking which track the state of profile image

if the profile is used then we will make it true so that same image cannot be used again.

contract SoulboundProfileNFT is ERC721, Ownable {
...
// keeping track of profile image if it is true or false
+ mapping(string => bool) public profileTracking;
​
function mintProfile(string memory name, uint8 age, string memory profileImage) external {
​
// checking if profile is already used
+ require(profileTracking[profileImage] == false, "Profile Image is already used");
​
...
// making sure that a profile image is never used again
+ profileTracking[profileImage] = true;
...
}
}
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_URI_injection_scam_underaged_bad_name_photo_etc

Scamming/phishing is not the protocol problem, that's a user mistake. NFT are unique, even if someone does a copy of your profile (which is also possible in web2), I consider it informational. Injection is a problem for the web2 part of the protocol, not a bug here. For the age, it depends on the countries law and future medicine. Anyways, that's more an ethical/political problem, not a bug.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.