059.md

Beautiful Iron Tadpole

High

Creation of profile is impossible

Summary

createProfile() is responsible for either creating a new profile, or adding an invited address to an already existing profile.

The issue is that if we want to create a new profile, it will always revert in _inviterProfileAuthorizedSender() due to retrieving a non-existing invite index and failing both parts of the if condition

Root Cause

The root cause is that we have no checks on a higher lever in createProfile() to let the function know if the specified address is invited, or an address that is to be assigned to a new profile.

So if we want to create a new profile, it will revert in _inviterProfileAuthorizedSender() due to an address not being in the invite list of the msg.sender (which is kind of expected, because this address is intended for a creation of a profile, not an addition to an already existing one)

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

1. Alice wants to create a brand new profile by calling createProfile()
2. The process will not complete due to the revert in __inviterProfileAuthorizedSender()

Impact

Profile can't be created and it will always result in a revert.

PoC

No response

Mitigation

Add a boolean to differentiate between creating a new profile and adding a new address to an already existing one.