DatingDapp

Root Cause:
The core issue is that the blockProfile function merely burns the user’s NFT and deletes the profile data, but it does not record the fact that an address has been blocked. There is no separate blacklist mapping or persistent ban flag to prevent a user from re-registering.

Impact:
If the goal is to permanently exclude certain users from the platform, then a malicious or misbehaving user who has been “blocked” can simply call mintProfile again and regain access. This undermines any administrative intent to permanently prevent a user from participating.

Recommendation:
Introduce a dedicated blacklist (or banned addresses mapping) that is checked in the mintProfile function (and possibly in other key functions). For example, adding a mapping such as mapping(address => bool) public isBlocked; and then modifying mintProfile to revert if isBlocked[msg.sender] is true will ensure that blocked users cannot simply re-create their profiles. Additionally, the blockProfile function should update this blacklist so that the blocked state persists beyond the deletion of the NFT.