DatingDapp

Summary

The SoulboundProfileNFT contract lacks robust age verification mechanisms, potentially enabling minors to create dating profiles. While some wallet services implement KYC, many non-custodial wallets don't require age verification, making this a significant vulnerability for a dating application.

Vulnerability Details

In the current implementation, the mintProfile function accepts any uint8 age parameter without validation.

The absence of age verification could allow users to input any age between 0 and 255, potentially enabling minors to create dating profiles.

Impact

• Legal Risks: Non-compliance with US regulations regarding minimum age requirements for dating applications

• Safety Concerns: Potential exposure of minors to adult dating environments

• Platform Liability: The platform could be held responsible for enabling underage dating activities

• Reputational Damage: Discovery of minors on the platform could severely impact the application's credibility

Tools Used

• Manual code review

Recommendations

1. Implement age verification by adding a require statement in the mintProfile function:

   function mintProfile(string memory name, uint8 age, string memory profileImage) external {

   require(profileToToken[msg.sender] == 0, "Profile already exists");

   require(age >= 18, "Must be 18 or older to create a dating profile");

   // Rest of the function remains the same

   ...

   }