DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Centralization Risk for trusted owners in `SoulboundProfileNFT::blockProfile`

0xshuayb

Summary

The blockProfile function in SoulboundProfileNFT allows the contract owner to block/delete a user's profile. The owner has to be trusted to not block a user's profile when the user is still an active user of the protocol

@> function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");
​
_burn(tokenId);
delete profileToToken[blockAddress];
delete _profiles[tokenId];
​
emit ProfileBurned(blockAddress, tokenId);
}

Impact

The owner can delete a user's profile, leading to the loss of the user's profile leaving them unable to use the protocol

Tools Used

Manual review

Recommendations

Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Admin is trusted

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.