# Users can self-follow via FollowNFT::tryMigrate() on Lens V2

Lens V2 blocks self-follows in FollowLib::follow, but FollowNFT::tryMigrate lets owners of a V1 self-follow NFT migrate it, creating a self-follow on V2.

- Payout: Audit contest
- Severity: medium
- Program: Lens Protocol
- Found by: juancito
- Disclosed: 2023-12-11
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-07-lens#m-09
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-lens%3AM-09
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** FollowNFT::tryMigrate / batchMigrateFollows migration path
**Root cause:** The V2 follow path enforces a SelfFollow revert, but the V1-to-V2 migration path in FollowNFT::tryMigrate lacks the equivalent followerProfileId == followedProfileId check.
**Steps:**
1. Obtain a V1 follow NFT where the follower profile equals the followed profile (e.g. profile 3659 token 42).
2. Call `hub.batchMigrateFollows([3659],[3659],[42])` with the self-follow profile and token id.
3. Observe `nft.isFollowing(3659)` returns true, confirming a V2 self-follow.
**How found:** Noticed FollowLib::follow explicitly reverts on self-follow, then checked the migration entry point for the same invariant and found it missing.
**Insight:** When a protocol adds an invariant check on one write path, audit every alternate path that writes the same state (migration, batch, legacy import) for the missing check.