The funds obtained from a burned or blocked profile is kept in the contract.
Summary
When a user profile is burned, the funds sent to the contract from likes are kept in the contract and not sent back to the user.
Vulnerability Details
When a user is burned using the SoulboundProfileNFT::burnProfile or the SoulboundProfileNFT::blockProfile, the funds sent to the contract from likes are kept in the contract and not sent back to the user.
Impact
Users who delete their accounts are not returned their funds.
Tools Used
N/A
Recommendations
Decide whether the owner of the contract should keep the money obtained from burned users, or the money should be sent back to the user.
If the money is to be sent back to the user, add a transfer in the
SoulboundProfileNFT::burnProfileand theSoulboundProfileNFT::blockProfilefunctions to send the money back to the user.
Appeal created
finding_blocking_or_burning_no_refund_balances_or_multisig
Likelihood: Low, burning with money in it would be a user mistake, and being blocked is Low. Impact: High, loss of funds
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.