DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Security Ticket: Reentrancy Vulnerability in mintProfile Function

rhaosec

Summary
A reentrancy vulnerability has been identified in the mintProfile function of the SoulboundProfileNFT contract. The function calls _safeMint, which in turn makes an external call to onERC721Received before updating the contract state. This allows a malicious contract to re-enter the mintProfile function and mint multiple NFTs before the state is updated.

Vulnerability Details

SoulboundProfileNFT.sol#30-41

Please look the below vulnerable code to understand it properly:

function mintProfile(string memory name, uint8 age, string memory profileImage) external {
require(profileToToken[msg.sender] == 0, "Profile already exists");
​
uint256 tokenId = ++_nextTokenId;
_safeMint(msg.sender, tokenId); //Mint before the state updating
​
// Store metadata on-chain
_profiles[tokenId] = Profile(name, age, profileImage);
profileToToken[msg.sender] = tokenId; //state updated after
​
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
}

Impact

  • This allows an attacker to mint multiple NFTs instead of only one.

  • It breaks the soulbound NFT logic, which ensures that each user has only one profile NFT.

Tools Used

Manual Method

Recommendations

--> Update the state before making external calls:

function mintProfile(string memory name, uint8 age, string memory profileImage) external {
require(profileToToken[msg.sender] == 0, "Profile already exists");
​
uint256 tokenId = ++_nextTokenId;
profileToToken[msg.sender] = tokenId;
_profiles[tokenId] = Profile(name, age, profileImage);
​
_safeMint(msg.sender, tokenId);// Mint after state update.
​
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);

--> Import OpenZeppelin’s ReentrancyGuard and mark mintProfile as nonReentrant:

Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_mintProfile_reentrancy

Likelihood: High, anyone can do it. Impact: Low, several profile will be minted, which is not allowed by the protocol, but only the last one will be stored in profileToToken and won't affect `likeUser` or `matchRewards`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.