s0x0mtee - Anyone can register themselves or any address to any profile and delete the address of the owners of those profiles (including Owner's profile) they choose without even having a profile.

[sherlock-admin2]

s0x0mtee

High

Anyone can register themselves or any address to any profile and delete the address of the owners of those profiles (including Owner's profile) they choose without even having a profile.

Summary

registerAddress() has no check to ensure profileIdByAddress(msg.sender) != 0 hence attackers(or even regular users ) can hijack other peoples profiles and registering their addresses to that profile. All they need is to know the profileId of the profile they want to hijack. Which can lead to lots and lots spam reviews and votes, which would reduce the integrity of the protocol.

Root Cause

• The lack of verification that caller of registerAddress() is registered to that profileId https://github.com/sherlock-audit/2024-10-ethos-network/blob/main/ethos/packages/contracts/contracts/EthosProfile.sol#L373-L409

Internal pre-conditions

1. Attacker/User calls registerAddress()
2. _profileShouldHaveInvites() returns true (The profile has not exceeded it's invite limit).

External pre-conditions

1. Attacker obtains the profileId of target profile.

Attack Path

1. Attacker/User calls registerAddress() with any valid profileId.

Impact

• Anyone can be affiliated/registered to not just ethos but almost any profile of their choice

PoC

No response

Mitigation

No response