DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Reentrancy Risk

gojo

Summary: In the contract SoulboundProfileNFT.sol, the state variable profileToToken[msg.sender] is updated after the function _safeMint() makes an external call. The state variable profileToToken[msg.sender] is updated after calling _safeMint, so the profileToToken[msg.sender] is still 0, allowing the attacker to mint multiple profiles.

Impact: Attacker could mint multiple profiles instead of just one.

Recommended Mitigation: To prevent, please follow Checks, Effects and Interaction pattern (CEI). Update the profileToToken mapping before calling _safeMint as shown below:
```solidity
function mintProfile(string memory name, uint8 age, string memory profileImage) external {
require(profileToToken[msg.sender] == 0, "Profile already exists");

uint256 tokenId = ++_nextTokenId;
​
// Move state update before external call
@> profileToToken[msg.sender] = tokenId;
_profiles[tokenId] = Profile(name, age, profileImage);
​
_safeMint(msg.sender, tokenId);
​
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
​
}
```
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_mintProfile_reentrancy

Likelihood: High, anyone can do it. Impact: Low, several profile will be minted, which is not allowed by the protocol, but only the last one will be stored in profileToToken and won't affect `likeUser` or `matchRewards`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.