Skip to content

Latest commit

 

History

History
84 lines (61 loc) · 2.34 KB

034.md

File metadata and controls

84 lines (61 loc) · 2.34 KB
Raw

Quiet Cyan Hyena

Medium

Users can not register an address to his profile.

Summary

A user can register multiple addresses to his profile. If the address has already been reviewed, it is tied to a mock profile id. Therefore, the registration of the address will be reverted.

https://github.com/sherlock-audit/2024-10-ethos-network/blob/main/ethos/packages/contracts/contracts/EthosProfile.sol#L394

Root Cause

When an address is reviewed, it is tied to a mock profile id in the following EthosProfile.incrementProfileCount() function.

  function incrementProfileCount(
    bool isAttestation,
    address subject,
    bytes32 attestation
  ) external whenNotPaused returns (uint256 profileId) {
    ...SKIP...
    profileId = profileCount;
    if (isAttestation) {
      profileIdByAttestation[attestation] = profileId;
    } else {
305:  profileIdByAddress[subject] = profileId;
    }
    ...SKIP...
  }

Next, EthosProfile.registerAddress() function is the following.

  function registerAddress(
    address addressStr,
    uint256 profileId,
    uint256 randValue,
    bytes calldata signature
  ) external whenNotPaused onlyNonZeroAddress(addressStr) {
    ...SKIP...
    (bool addressAlreadyRegistered, , , uint256 registeredProfileId) = profileStatusByAddress(
      addressStr
    );
394:if (addressAlreadyRegistered && registeredProfileId != profileId) {
      revert ProfileExistsForAddress(addressStr);
    }
    ...SKIP...

As can be seen, if addressStr has already been reviewed, since addressAlreadyRegistered = true and registeredProfileId != profileId in L394, it will be reverted.

Internal pre-conditions

  • A user has two addresses.
  • One of the user's address is already reviewed by reviewer.

External pre-conditions

No response

Attack Path

  1. A user has two address: 'addr1andaddr2`.
  2. addr2 has already been reviewed and is tied to a mock profile id.
  3. The user create profile with addr1.
  4. The user call registerAddress to register addr2 to his own profile.
  5. The function call is reverted with ProfileExistsForAddress error in L395.

Impact

Breaks core contract functionality because users can't register multiple addresses to his profile.

PoC

No response

Mitigation

If an address to register is tied to a mock profile, allow the address to be registered.