DatingDapp
AI First Flight #6
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: low
Invalid

MEDIUM-02 — Centralization risk: owner can delete any user's profile

goat

MEDIUM-02 — Centralization risk: owner can delete any user's profile

Description

  • blockProfile allows the contract owner to permanently burn any user's NFT profile without providing a reason, without prior warning, and without any appeal mechanism. Users have no protection against arbitrary removal.

// @> owner has unchecked unilateral power over all user profiles
function blockProfile(address blockAddress) external onlyOwner {
_burn(tokenId);
delete profileToToken[blockAddress];
delete _profiles[tokenId];
}

Risk

Likelihood:

  • Can be called by owner at any time for any reason — or as a result of a compromised owner key.

Impact:


  • Users permanently lose their profile and associated data with no recourse. If owner key is compromised, attacker can wipe all profiles.

Proof of Concept

function testPoCBlockProfile() public {
vm.prank(user);
soulboundNFT.mintProfile("Alice", 25, "ipfs://profileImage");
​
uint256 tokenId = soulboundNFT.profileToToken(user);
assertEq(tokenId, 1, "Token should exist before blocking");
​
vm.prank(owner);
soulboundNFT.blockProfile(user);
​
uint256 newTokenId = soulboundNFT.profileToToken(user);
assertEq(newTokenId, 0, "Token should be removed after blocking");
}

Recommended Mitigation

+ event ProfileBlocked(address indexed user, string reason, uint256 timestamp);
+ mapping(address => bool) public blockedUsers;
​
- function blockProfile(address blockAddress) external onlyOwner {
+ function blockProfile(address blockAddress, string calldata reason) external onlyOwner {
+ blockedUsers[blockAddress] = true;
+ emit ProfileBlocked(blockAddress, reason, block.timestamp);
- _burn(tokenId);
- delete profileToToken[blockAddress];
- delete _profiles[tokenId];
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 8 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!