DatingDapp

Missing Persistent Blocklist in blockProfile Allows Blocked Users to Re-mint

Description

• blockProfile is the owner's moderation tool — it is intended to permanently remove a malicious or abusive user from the platform by burning their NFT.

• blockProfile calls delete profileToToken[blockAddress], which resets the mapping value to 0. Since mintProfile only gates on require(profileToToken[msg.sender] ==
  0, "Profile already exists"), a blocked address immediately satisfies that check again and can re-mint a fresh profile in the very next transaction, completely
  bypassing the block.

function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");

  _burn(tokenId);                                       

@> delete profileToToken[blockAddress]; // resets to 0 — no persistent record of block
delete _profiles[tokenId];

  emit ProfileBurned(blockAddress, tokenId);                                                                                                                       

}

function mintProfile(string memory name, uint8 age, string memory profileImage) external {
@> require(profileToToken[msg.sender] == 0, "Profile already exists"); // passes immediately after block
uint256 tokenId = ++_nextTokenId;
_safeMint(msg.sender, tokenId);
_profiles[tokenId] = Profile(name, age, profileImage);
profileToToken[msg.sender] = tokenId;
emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
}

Risk

Likelihood:

• Any blocked user re-mints their profile in one transaction immediately after being blocked — the bypass requires zero special knowledge or capital.

• Admin-blocked users who re-mint retain all their prior likes mappings in LikeRegistry, re-entering the protocol with their full old like history intact.

Impact:

• The only moderation mechanism in the protocol is rendered completely ineffective — blocked users regain full platform access immediately after removal.

• A malicious user blocked for abuse, spam, or fraud can continue their behaviour indefinitely with no friction beyond a single gas fee per block.

Proof of Concept

function test_M01_BlockedUserCanRemint() public {
vm.prank(user);
soulboundNFT.mintProfile("Alice", 18, "ipfs://profileImageAlice");

  // Owner blocks the user                                                                                                                                         
  vm.prank(owner);                                                                                                                                                 
  soulboundNFT.blockProfile(user);                                                                                                                                 
  assertEq(soulboundNFT.profileToToken(user), 0);       

  // Blocked user immediately re-mints — no error                                                                                                                  
  vm.prank(user);
  soulboundNFT.mintProfile("Alice", 18, "ipfs://profileImageAlice");                                                                                               
                                                        
  // Block had zero effect                                                                                                                                         
  assertEq(soulboundNFT.profileToToken(user), 2);

}

Recommended Mitigation

• mapping(address => bool) public isBlocked;

function mintProfile(string memory name, uint8 age, string memory profileImage) external {

• require(!isBlocked[msg.sender], "Account is permanently blocked");
  require(profileToToken[msg.sender] == 0, "Profile already exists");

  uint256 tokenId = ++_nextTokenId;
  _safeMint(msg.sender, tokenId);
  _profiles[tokenId] = Profile(name, age, profileImage);
  profileToToken[msg.sender] = tokenId;
  emit ProfileMinted(msg.sender, tokenId, name, age, profileImage);
  }

function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");

  _burn(tokenId);
  delete profileToToken[blockAddress];                                                                                                                             
  delete _profiles[tokenId];                            

• isBlocked[blockAddress] = true;

  emit ProfileBurned(blockAddress, tokenId);
  }