DatingDapp
AI First Flight #6
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

M-3: Burn/block leaves stale `likes`/`matches`; blocked user keeps wallet ownership

rubabbel

Root + Impact

burnProfile/blockProfile never clear LikeRegistry state, and pre-existing MultiSigWallet owners are immutable. A re-minted identity inherits surviving likes and can instantly re-match; a blocked user retains control over prior wallets; getMatches() returns phantom partners.

Description

// src/SoulboundProfileNFT.sol — burns NFT only
function burnProfile() external {
...
_burn(tokenId);
@> delete profileToToken[msg.sender]; // LikeRegistry.likes/matches untouched
delete _profiles[tokenId];
}
​
// src/LikeRegistry.sol — stale likes still satisfy the mutual check
if (likes[liked][msg.sender]) {
@> // a surviving like from a burned/blocked identity fires a match
...
}

Risk

Likelihood: Medium — requires burn/block then re-mint.

Impact: Identity cannot be cleanly removed; stale mutual likes re-trigger matches and blocked users keep wallet authority.

Proof of Concept

function test_StaleLikesSurviveBurn() public {
_mint(alice); _mint(bob);
vm.deal(alice, 1 ether); vm.deal(bob, 1 ether);
​
vm.prank(alice); registry.likeUser{value: 1 ether}(bob);
​
vm.prank(bob); nft.burnProfile();
vm.prank(bob); nft.mintProfile("bob", 25, "ipfs://b");
​
vm.prank(bob); registry.likeUser{value: 1 ether}(alice);
// survived likes[alice][bob] instantly re-match the fresh identity
vm.prank(alice);
assertEq(registry.getMatches().length, 1);
}

Recommended Mitigation

+// LikeRegistry
+function clearUser(address user, address[] calldata counterparties) external {
+ require(msg.sender == address(profileNFT) || msg.sender == owner(), "auth");
+ for (uint i; i < counterparties.length; ++i) {
+ likes[user][counterparties[i]] = false;
+ likes[counterparties[i]][user] = false;
+ }
+ delete matches[user];
+}

Call it from burnProfile/blockProfile (or use a registry hook), and prevent blocked addresses from becoming wallet owners.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 6 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!