Per the comment in ApprovalFollowModule, it aims to create a whitelist system:
However, the current implementation only validates if _approvedByProfileByOwner when minting a new followNFT. But since the follow relationship is verified by the followNFT and the followNFT can be transferred to an arbitrary address.
As a result, a non-whitelisted address can bypass the whitelist by buying the followNFT from a whitelisted address.
The followModuleTransferHook can be used for blocking transfers to unapproved addresses.
FollowValidatorFollowModuleBase.sol#L23-L38
Change to:
oneski (Aave Lens) disputed and commented:
0xleastwood (judge) commented:
Zer0dot (Aave Lens) disagreed with Medium severity and commented:
0xleastwood (judge) commented:
Zer0dot (Aave Lens) commented:
0xleastwood (judge) decreased severity to Low and commented:
For this contest, 12 reports were submitted by wardens detailing gas optimizations. The report highlighted below by Dravee received the top score from the judge.
The following wardens also submitted reports: IllIllI, Jujic, 0x0x0x, csanuragjain, defsec, nahnah, d4rk, rfa, pauliax, gzeon, and 0x1f8b.
