The blockProfile
function allows the contract owner to remove a user's profile by burning their NFT and deleting associated metadata. However, this function does not actually prevent the blocked user from minting a new profile with the same address
. Since blockProfile
only deletes profileToToken[blockAddress]
and _profiles[tokenId]
, the user can simply call mintProfile
again and receive a new soulbound NFT.
Additionally, the function does not remove the user's interactions from the likes mapping
, meaning that blocked users retain all previous likes and matches
, effectively bypassing the ban.
This violates the integrity of the contract
, as users who were removed can continue participating in the system as if nothing happened
, potentially allowing abuse and spam.
Bypassing Moderation: The contract fails to enforce a true ban, allowing blocked users to create new profiles instantly.
Retaining Previous Interactions: A banned user retains all previous likes and matches, maintaining their influence in the system.
This could allow malicious actors to exploit the system by continuously creating new profiles after being blocked.
manual
Add this function to SoulboundProfileNFT.sol
Implement a blockedUsers mapping
to prevent blocked users from creating new profiles:
Likelihood: Low, any blocked users. Impact: High, not really blocked.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.