DatingDapp

Description

• Normal behavior: LikeRegistry should be deployed pointing at a valid, correct SoulboundProfileNFT contract, since every likeUser() call depends on it.

• Specific issue: the constructor accepts _profileNFT with zero validation, and no setter exists anywhere to correct it after deployment.

Risk

Likelihood:

• Requires deployer error at deploy time; a plain wrong address with no code reverts loudly on first real usage (Solidity's automatic call check on external calls with return values), so this is not a silently exploitable condition.

Impact:

• If misconfigured, every profile-dependent check in likeUser() breaks, and there is no way to correct profileNFT post-deploy short of redeploying the entire contract.

Proof of Concept

No executable PoC is included for this finding: the bug is a missing validation check that only manifests if the deployer themselves passes a bad address at deploy time — there is no transaction or external actor that can trigger it against a correctly-deployed contract. The issue is fully demonstrated by the constructor's source alone (compare against MultiSigWallet's constructor in the same codebase, which does validate its equivalent address parameters).

Recommended Mitigation

A single zero-address check at the point of assignment prevents the most common deployment mistake (an empty/placeholder value making it into production) and costs nothing at runtime after deployment — it only runs once, in the constructor.