# Users can make any user follow them via FollowNFT::tryMigrate() without their consent

FollowNFT.tryMigrate lets anyone set a victim's follow state by transferring a v1 follow NFT to them, forcing unwanted follows.

- Payout: Audit contest
- Severity: medium
- Program: Lens Protocol
- Found by: juancito
- Disclosed: 2023-12-11
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2023-07-lens#m-10
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-lens%3AM-10
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** FollowNFT migration function (batchMigrateFollows/tryMigrate) on Lens hub
**Root cause:** tryMigrate writes _followDataByFollowTokenId[followerProfileId] from caller-supplied args and only checks that the follow token owner equals the follower profile owner, so transferring a v1 follow NFT to a victim makes them appear to follow the token's original subject.
**Steps:**
1. Adversary owns a v1 follow NFT (e.g. tokenId 42) and a profile (3659).
2. `nft.transferFrom(adversary, hub.ownerOf(victimProfileId), followTokenId)` sends the follow NFT to the victim's address.
3. Call `hub.batchMigrateFollows([victimProfileId],[adversaryProfileId],[followTokenId])` (permissionless).
4. `nft.isFollowing(victimProfileId)` now returns true.
**How found:** Compared access control on _baseFollow (owner/delegate only) against tryMigrate, which also writes follow state but is onlyHub and permissionless; noticed the sole guard is followerProfileOwner == ownerOf(followTokenId), which is satisfiable by transferring the NFT.
**Exploitation:** Attacker transfers any v1 follow NFT to the victim's profile owner address, then calls the permissionless batchMigrateFollows; tryMigrate sets the victim's follow mapping to the attacker's profile, making prestigious profiles follow scam accounts. Attacker can frontrun legitimate migrations by moving tokens so migration silently returns 0.
**Escalation:** Can be repeated at any time and used to make high-reputation profiles legitimize scam accounts; frontrunning blocks others' migrations.
**Insight:** When a migration path writes the same state as a guarded function, diff the guards: any check based on current token ownership rather than original mint provenance can be satisfied by transferring the token to the victim.