Submitted by juancito, also found by evmboi32 and Emmanuel
Users are not supposed to be able to self-follow on Lens v2, but they are able to bypass the restriction. This can also affect modules or newer functionalities that count on this behaviour.
Migration is an Area of specific concern for the devs, and this can easily be prevented with a simple check.
This cant be undone without any upgrade.
FollowLib::follow() has a specific restriction to revert when a user tries to self-follow on Lens v2:
FollowLib.sol#L35-L37
However, users that own a follow NFT from V1 can execute FollowNFT::tryMigrate() to self-follow on V2, as there is no restriction to prevent it. A test proving it can be found on the next section.
FollowNFT.sol#L480-L520
Add this test to test/migrations/Migrations.t.sol and run TESTING_FORK=mainnet POLYGON_RPC_URL="https://polygon.llamarpc.com" forge test --mt "testSelfFollow".
Note: In case of a memory allocation error during the Forge test, please comment these lines. They are not used for the current test.
Add the following validation to FollowNFT::tryMigrate():
Invalid Validation
vicnaum (Lens) confirmed and commented:
Picodes (judge) commented:
