# It’s possible to follow deleted profiles

Following a profile by handle only checks handle existence, so a recycled handle lets a user follow a deleted profile instead of the new one.

- Payout: Audit contest
- Severity: medium
- Program: Aave Lens
- Found by: danb
- Disclosed: 2022-06-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-02-aave-lens#m-07
- Library page: http://bugbountylibrary.com/r/c4%3A2022-02-aave-lens%3AM-07
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** InteractionLogic.sol follow logic (smart contract)
**Root cause:** The follow check only verifies that a profile exists for the handle hash (`_profileIdByHandleHash[...] == 0`), not that it matches the intended profileId, so a reused handle passes the check for the deleted profile.
**Steps:**
1. Alice creates profile handle "alice", id 1.
2. Alice deletes profile 1.
3. Alice creates new profile handle "alice", id 2.
4. Bob calls follow for deleted profile id 1 with handle "alice"; check `if (_profileIdByHandleHash[keccak256(bytes(handle))] == 0) revert Errors.TokenDoesNotExist();` passes because handle exists.
5. Bob's follow is recorded against deleted profile 1 instead of profile 2.
**How found:** Code review of the follow path: noticed the handle existence check compares only against zero rather than the target profileId, then reasoned about handle reuse after deletion.
**Exploitation:** Attacker or unaware user follows a deleted profile id by supplying a handle that now belongs to a different profile; the existence check passes and the follow is recorded on the stale profile id.
**Insight:** When resolving a mutable namespace (handles) to an id, verify the resolved id equals the requested id; existence-only checks break once names are recycled after deletion.