durov - Review authors should be able to archive and restore reviews from any address that belongs to the profile

[sherlock-admin2]

durov

Medium

Review authors should be able to archive and restore reviews from any address that belongs to the profile

Summary

In EthosReview.sol authors of reviews can archive and restore reviews only from the original address, even though the profile can have multiple address registered to it.

function archiveReview(uint256 reviewId) external whenNotPaused {
    (bool exists, ) = targetExistsAndAllowedForId(reviewId);

    if (!exists) {
      revert ReviewNotFound(reviewId);
    }

    Review storage review = reviews[reviewId];

    if (review.archived) {
      revert ReviewIsArchived(reviewId);
    }

    if (review.author != msg.sender) {
      revert UnauthorizedArchiving(reviewId);
    }

    review.archived = true;

    emit ReviewArchived(reviewId, msg.sender, review.subject);
  }

  function restoreReview(uint256 reviewId) external whenNotPaused {
    _getEthosProfile().verifiedProfileIdForAddress(msg.sender);
    Review storage review = reviews[reviewId];

    if (review.author == address(0)) {
      revert ReviewNotFound(reviewId);
    }

    if (review.author != msg.sender) {
      revert UnauthorizedArchiving(reviewId);
    }

    if (!review.archived) {
      revert ReviewNotArchived(reviewId);
    }

    review.archived = false;

    emit ReviewRestored(reviewId, msg.sender, review.subject);
  }

https://github.com/sherlock-audit/2024-10-ethos-network/blob/main/ethos/packages/contracts/contracts/EthosReview.sol#L287-L332

Root Cause

Checks in EthosReview:300, EthosReview:321

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Authors can't archive or restore their reviews from different addresses belonging to the same profile, even though they can edit their reviews from different addresses.

PoC

No response

Mitigation

Let authors archive or restore their reviews from any address that belongs to their profile.

[sherlock-admin2]

The protocol team fixed this issue in the following PRs/commits:
https://github.com/trust-ethos/ethos/pull/1763