096.md

Sparkly Seaweed Wolf

High

Compromised address can still invite users and do some key operations

Summary

The missing check in EthosProfile::inviteAddress() will allow that compromised msg.sender to invite users.

Root Cause

In EthosProfile.sol:210, users can invite other users into Ethos. The problem is that we miss check whether msg.sender is one compromised address. In inviteAddress, we check msg.sender belongs to one active profile. But if one address is compromised and deleted by the profile, the variable profileIdByAddress will still keep. So one compromised address can still invite users. This is unexpected behaviour.

  function inviteAddress(
    address invitee
  ) public whenNotPaused onlyNonZeroAddress(invitee) checkIfCompromised(invitee) {
    (bool verified, bool archived, bool mock, uint256 profileId) = profileStatusByAddress(
      msg.sender
    );
    ...
}
  function profileStatusByAddress(
    address addressStr
  ) public view returns (bool verified, bool archived, bool mock, uint256 profileId) {
    profileId = profileIdByAddress[addressStr];
    (verified, archived, mock) = profileStatusById(profileId);
  }

Internal pre-conditions

1. One compromised address is deleted by the profile.

External pre-conditions

N/A

Attack Path

1. One address is compromised and is deleted by the profile owner.
2. The compromised address can still invite users and do some key operations, for example, delete other addresses which belong to the same profile.

Impact

If one address is compromised and deleted by the profile owner. This compromised address can still invite users, delete other addresses in this profile and do some other key operations.

PoC

N/A

Mitigation

We need to add one check whether msg.sender is compromised in inviteAddress(), deleteAddressAtIndex(), etc.