Submission Details
Impact:
Likelihood:
SoulboundProfileNFT transferFrom(..) and safeTransferFrom(...) Restriction Can Be Bypassed Through Missing Overload.
Root + Impact
The version of openzeppelin ERC721.sol includes another transfer mechanism which wasnt overridden.
Description
The contract overrides:
(https://github.com/CodeHawks-Contests/2025-02-datingdapp/blob/878bd34ef6607afe01f280cd5aedf3184fc4ca7b/src/SoulboundProfileNFT.sol#L69)
and
https://github.com/CodeHawks-Contests/2025-02-datingdapp/blob/878bd34ef6607afe01f280cd5aedf3184fc4ca7b/src/SoulboundProfileNFT.sol#L74
but not:
```solidity
safeTransferFrom(
address from,
address to,
uint256 tokenId
)
```
This basically bypasses the other overrides.
// Root cause in the codebase with @> marks to highlight the relevant section
Risk
Likelihood:
Likely
Impact:
Proof of Concept
Recommended Mitigation
Explicitly override both transfer variants, This removes version-dependent behavior.
function safeTransferFrom(
address,
address,
uint256
) public pure override {
revert SoulboundTokenCannotBeTransferred();
} + add this code
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.