Any caller can reserve someone else’s email and associate it with their own identity
Source references: 3The registration endpoint accepts any caller-supplied email, creates the caller-to-email association, reserves the uniqueness record, and adds it to a marketing topic before proving ownership. It sends verification only afterward.
An attacker can register a victim’s address, preventing its real owner from registering because it is already taken. If the owner clicks the received verification link, the address may also become verified for the profile created under the attacker’s principal and eligible for marketing sent through that profile.
Before proving ownership, registration stores any caller-supplied email in that caller's profile and in a global uniqueness set. A later registrant using it receives “Email already taken.” If this example is adopted, a caller could therefore reserve someone else's address and block its real owner; sending verification afterward does not undo that association. Users can ask that addresses not be permanently reserved until verification succeeds, with strict limits and expiry for unverified records.
public shared ({ caller }) func registerUser(name : Text, email : Text) : async () { // Check if the user already exists if (userProfiles.containsKey(caller)) { Runtime.trap("User already registered"); }; // Check if the email is already used if (emails.contains(email)) { Runtime.trap("Email already taken"); }; // Add a user record userProfiles.add( caller, { name; email; }, ); emails.add(email); // Subscribe the user to the Newsletter topic by defaultShow 2 other places
emails.add(email); // Subscribe the user to the Newsletter topic by default let topicId = EmailSubscribers.getTopicId(emailSubscribers, newsletterTopic) ?? Runtime.trap("Newsletter topic not found"); ignore EmailSubscribers.add(emailSubscribers, topicId, email); // Send a verification email let result = await EmailClient.sendVerificationEmail( "no-reply", [email], "Welcome to Our Service", "Hello " # name # ",<br><br>Thank you for registering with our service.<br><br>Please <a href=\"{{VERIFICATION_URL}}\">click here</a> to verify your email address.<br><br>By clicking on the verification link you also agree to sign-up to the monthly Newsletter which you can unsubscribe from at any time.<br><br>Best regards,<br>The Team", ); ignore EmailSubscribers.add(emailSubscribers, topicId, email); // Send a verification email let result = await EmailClient.sendVerificationEmail( "no-reply", [email], "Welcome to Our Service", "Hello " # name # ",<br><br>Thank you for registering with our service.<br><br>Please <a href=\"{{VERIFICATION_URL}}\">click here</a> to verify your email address.<br><br>By clicking on the verification link you also agree to sign-up to the monthly Newsletter which you can unsubscribe from at any time.<br><br>Best regards,<br>The Team", );