Submitted by klau5, also found by Emmanuel
You can migrate V1 followers by calling the LensV2Migration.batchMigrateFollows function, which can be called by anyone.
https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/misc/LensV2Migration.sol#L37-L43
https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/libraries/MigrationLib.sol#L114-L139
The FollowNFT.tryMigrate is where the actual migration logic proceed.  FollowNFT.tryMigrate does not check whether the followerProfileId has been blocked by the idOfProfileFollowed.
https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/FollowNFT.sol#L480-L520
Lets think the case that the idOfProfileFollowed profile blocked the followerProfileId when the follower has not yet migrated. In this case, if the owner of the followerProfileId or anyone else calls LensV2Migration.batchMigrateFollows, then the blocked followerProfileId can follow the idOfProfileFollowed.
The following codes are the PoC codes. Add and modify https://github.com/code-423n4/2023-07-lens/blob/main/test/migrations/Migrations.t.sol to run PoC.
First, modify the test because it is broken due to a change of the return value of getProfile. Add the following interface at Migrations.t.sol test file.
Also modify the following code to recover broken tests. https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/test/migrations/Migrations.t.sol#L107
Add this test function at  MigrationsTest contract and run. Even after being blocked, it is possible to follow through batchMigrateFollows.
At FollowNFT.tryMigrate function, If the follower is blocked, make it unfollowed.
Invalid Validation
vicnaum (Lens) confirmed and commented:
Picodes (judge) commented:
For this audit, 23 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by MiloTruck received the top score from the judge.
The following wardens also submitted reports: juancito, Kaysoft, AlexCzm, MohammedRizwan, BugzyVonBuggernaut, Prestige, Sathish9098, Emmanuel, ihtishamsudo, tnquanghuy0512, adeolu, Rolezn, evmboi32, mrudenko, fatherOfBlocks, Iurii3, 0xAnah, descharre, Stormreckson, Bughunter101, DavidGiladi, and ginlee.
