DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Centralization Risk for trusted owners

2ace

Summary

Contracts have owners with privileged rights to perform admin tasks and need to be trusted to not perform malicious updates. The Owner has the privilege of blocking any user.

Vulnerability Details

In SoulboundProfileNFT

@> function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");
​
_burn(tokenId);
delete profileToToken[blockAddress];
delete _profiles[tokenId];
​
emit ProfileBurned(blockAddress, tokenId);
}
​

Impact

A malicious owner can casually block any user he wants. Hence preventing the user from liking or being liked by another user denying him a potential match.

Tools Used

Manual review

Recommendations

Minimise owner privilege that might disadvantage users.

Updates

Appeal created

n0kto Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Admin is trusted

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.