DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of validation for name, age and profileImage allows empty and invalid profiles

guzbyte

Summary

The SoulboundProfileNFT mintProfile function allows users to mint a profile NFT without validating the name, age, and profileImage fields. This allows empty or unrealistic values to be stored on-chain.

Vulnerability Details

The function mintProfile does not enforce name, age, and profileImage parameters constraints. This allows users to create profiles with empty strings or unrealistic values, which may lead to:

  • Meaningless or spam entries in the contract’s data.

  • Potential exploitation where users abuse the lack of constraints (e.g., impersonation or garbage data insertion).

Impact

The absence of validation could lead to:

  • Data integrity issues: Garbage or incomplete profile data stored permanently on-chain.

  • Potential UX problems: Applications relying on this data might break or require extra filtering.

Proof of Code

function testMintProfileWithEmptyFilled() public {
vm.prank(user); // Simulates user calling the function
soulboundNFT.mintProfile("", 0, "");
​
uint256 tokenId = soulboundNFT.profileToToken(user);
assertEq(tokenId, 1, "Token ID should be 1");
​
string memory uri = soulboundNFT.tokenURI(tokenId);
console.log(uri);
​
assertTrue(bytes(uri).length > 0, "Token URI should be set");
}
​
Ran 1 test for test/testSoulboundProfileNFT.t.sol:SoulboundProfileNFTTest
[PASS] testMintProfileWithEmptyFilled() (gas: 133608)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 72.36ms (2.83ms CPU time)
​
Ran 1 test suite in 452.49ms (72.36ms CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)

Tools Used

Manual Review
Foundry

Recommendations

  • Require non-empty name and profileImage

require(bytes(name).length > 0, "Name cannot be empty");
require(bytes(profileImage).length > 0, "Profile image cannot be empty");

  • Set a reasonable constraint on age, e.g., ensuring it is within a valid range

require(age > 0 && age < 150, "Invalid age");
Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_URI_injection_scam_underaged_bad_name_photo_etc

Scamming/phishing is not the protocol problem, that's a user mistake. NFT are unique, even if someone does a copy of your profile (which is also possible in web2), I consider it informational. Injection is a problem for the web2 part of the protocol, not a bug here. For the age, it depends on the countries law and future medicine. Anyways, that's more an ethical/political problem, not a bug.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.