DatingDapp

Summary

The blockProfile() function in the SoulboundProfileNFT contract is intended to restrict problematic users from participating in the system. However, the current implementation only deletes the profile associated with a user, allowing them to simply recreate a new profile. Since there is no mechanism to prevent the blocked user from generating a new profile, the restriction is ineffective, and banned users can easily circumvent the system.

Vulnerability Details

The existing blockProfile() function only removes a profile by deleting its associated profile ID. This action does not prevent the blocked user from interacting with the contract again or creating a new profile under the same address or through a different contract. Consequently, if a user is banned for violating platform policies, they can simply call mintProfile() again and generate a new profile without any restrictions.

The core issue is that there is no persistent tracking of blocked users at the address or account level. Since profile IDs are temporary and tied to user-generated actions rather than the originating account, banning a profile ID does not effectively ban the underlying user. A more robust restriction should prevent the user from re-engaging with the system entirely, even if they attempt to create a new profile.

Impact

The inability to effectively block problematic users reduces the contract's ability to enforce penalties and maintain system integrity. Since blocked users can easily rejoin, moderation efforts become meaningless, and bad actors may continuously exploit vulnerabilities or disrupt the platform. Over time, this can erode trust in the system and create security risks, as there is no reliable method to prevent repeated abuse. The lack of a proper blacklist mechanism also increases the risk of persistent rule violations, making it difficult for the platform to enforce any meaningful restrictions.

Tools Used

Manual Audit

Recommendations

To properly enforce restrictions, the contract should implement a blacklist system that prevents blocked users from creating new profiles. This can be achieved by maintaining a mapping of origin addresses and checking it before allowing a new profile to be minted.

A recommended solution involves tracking the original transaction sender (tx.origin) at the time of profile creation. The contract should store tx.origin in a mapping and verify it during the mintProfile() function. If a user has been previously blacklisted, the contract should deny the profile creation request, effectively preventing the blocked user from bypassing the restriction.

Additionally, when blockProfile() is called, the contract should not only delete the profile but also add the user’s tx.origin to a blacklist mapping, ensuring that they cannot interact with the contract again. The following modification to the contract illustrates this approach:

By implementing this blacklist mechanism, the contract ensures that blocked users cannot re-enter the system, even if they attempt to create a new profile or interact through a different contract. This enhancement strengthens security, prevents abuse, and ensures effective enforcement of platform rules.