Submitted by joestakey, also found by MiniGlome, adriro, libratus, shenwilly, glcanvas, wait, csanuragjain, Ruhum, hihen, and chaduke
AddressRegistry.sol#L47
Users can register their on-chain identity (ie their CID NFT) by calling AddressRegistry.register()
This overwrites cidNFTs[msg.sender] with the cidNFTID provided by the caller.
The issue is that there is nothing preventing several (2 or more) accounts to point to the same cidNFTID, ie have cidNFTs[userA] == cidNFTs[userB]
Note: the README mentioned that
The issue described in this report is not that the CID NFT is transferrable, but that several accounts can point to the same CIDNFT id, which lead to several problems outlined below.
Quoting the README:
Here, several accounts can point to the same on-chain identity, breaking the requirement that the said identity should be individual.
To illustrate the consequences of this, let us look at CidNFT.add(), which adds a new entry for the given subprotocol to the provided CID NFT:
Because of the issue outlined above, the identity system can be abused:
Overall, because this issue impacts a key aspect of the protocol (identities are not individual) and can lead to a form of theft in certain conditions (in the scenario above, Alice got a trait added to her identity for free), the Medium severity seems appropriate.
This test shows how two users can point to the same CID.
Add it to AddressRegistry.t.sol
Manual Analysis, Foundry
AddressRegistry should have an additional mapping to track the account associated with a given cifNTFID.
When registering, the code would check if the cidNFTID has an account associated with it.
If that is the case, cidNFTs for this user would be set to 0, preventing several users from having the same identity.
OpenCoreCH (Canto Identity) confirmed and commented:
