DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Users lose their ETH if no match happens

beskay

Summary

Users pay 1 ETH to "like" another profile. If the like is mutual (a match), all payments are pooled into a shared multisig wallet. However, if no match happens, the ETH is unrecoverable.

Vulnerability Details

By calling function likeUser, users express interest in another user and send > 1 ETH to the contract. If a match happens, these ETH are sent to a multisig wallet. However, if no match happens, that ETH is lost, since no function exists to recover paid ETH.

Impact

Users lose their ETH

Tools Used

Foundry

Recommendations

Include a function to recover sent ETH, e.g.

function withdraw() external {
uint256 balance = userBalances[msg.sender];
require(balance > 0, "No balance to withdraw");
​
userBalances[msg.sender] = 0;
(bool success,) = payable(msg.sender).call{value: balance}("");
require(success, "Transfer failed");
}

To prevent abusing likeUser by liking every other user and then simply withdrawing all ETH, the mapping likes should be deleted as well.

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.