Submission Details
Impact:
Likelihood:
L-5: Profiles are unverified — free impersonation, no age sanity check
L-5: Profiles are unverified — free impersonation, no age sanity check
Summary
The README calls the NFT a "verified dating profile", but mintProfile takes arbitrary name/profileImage with zero verification — anyone can mint as "Alice, 25" with someone else's photo, then farm 1-ETH likes they never reciprocate (compounds M-1). Additionally age is an unchecked uint8 (0 and 255 both accepted).
Recommended mitigation
At minimum document that profiles are self-asserted; validate age within a sane range.
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.