Cheerful Opal Viper
Medium
When a profile consists of only one address and that address is compromised, there will be no way to delete that address and the profile associated with it will be lost and be able to take any action in the name of the original user.
The protocol takes care of compromised addresses by allowing and encouraging users to call EthosProfile::deletedeleteAddressAtIndex() whenever one of the addresses that are connected to his profile are affected.
However, this can only be done by another address connected to the same profile.
As, according to the documentation, users are only encouraged to register multiple addresses to their profile, they are not forced to do so. Therefore, it is possible for profiles to be connected to only one address. If that is the case and this address is compromised, there will be no way to delete that address.
- ProfileA invites AddressB.
- AddressB accepts the invite and calls
EthosProfile::createProfile()to create his own profile (ProfileB). - AddressB is the only address connected to ProfileB.
- AddressB can now take any action on behalf of ProfileB, as there are now limitations for profiles consisting of only one address.
- AddressB is compromised.
- There is no way to delete that compromised address and the profile will be lost.
The profile of the affected user will be lost and any action can be taken in the name of the original user, such as adding and editing votes, reviews and replies.
Manual Review
Consider adding an admin function to delete a profile that is connected to only one address. Another option is to force users to add multiple addresses to their pofile.