DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Misleading event name in the `SoulboundProifleNFT::blockProfile` function.

oxenzo

Description:

The blockProfile function is designed to allow the contract owner to block a user by burning their profile NFT and removing their metadata. However, it emits the ProfileBurned event, which is also used in the burnProfile function when users voluntarily delete their profiles. This creates ambiguity in the event logs, as external observers cannot distinguish between a profile being voluntarily deleted and one being forcefully blocked by the contract owner.

Impact:

Users may be unaware that their profile was blocked rather than voluntarily removed, potentially leading to confusion and disputes.

Proof of Concept:

The following function emits the incorrect event:

​
function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");
​
_burn(tokenId);
delete profileToToken[blockAddress];
delete _profiles[tokenId];
​
@> emit ProfileBurned(blockAddress, tokenId);
}
​

Since the ProfileBurned event is also emitted in the burnProfile function, there is no way to differentiate between user-initiated burns and admin-enforced blocks.

Recommended Mitigation:

Introduce a new event specifically for blocked profiles:

event ProfileBlocked(address indexed user, uint256 tokenId);

Then now make the following change:

function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");
​
_burn(tokenId);
delete profileToToken[blockAddress];
delete _profiles[tokenId];
​
- emit ProfileBurned(blockAddress, tokenId);
+ emit ProfileBlocked(blockAddress, tokenId); // Correct event name
}
​

This ensures clarity in the contract's event logs and allows users and external applications to distinguish between different profile removal actions.

Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.