DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Transaction Disapproval Function in MultiSig contract

0xblackadam

Description

The MultiSigWallet contract, designed for dating app users, lacks a critical function to disapprove/revoke transaction approvals. In a dating context, this is particularly severe because:

  • After a bad date or relationship change, one party may want to revoke their approval

  • Malicious actors could create and approve harmful transactions, then wait for the other party to blindly approve

  • Once approved, there's no way to change your mind even if red flags appear

  • Trust dynamics in dating relationships can change suddenly and dramatically

Impact:

  • Users are locked into their approvals even after discovering concerning behavior

  • Could be used as a form of financial manipulation in toxic relationships

  • No recourse if one party becomes threatening or untrustworthy after approval

Recommended Mitigation Steps

Add a disapproval function and modify the approval tracking:

/// @notice Allows an owner to revoke their approval
function disapproveTransaction(uint256 _txId) external onlyOwners {
require(_txId < transactions.length, "Invalid transaction ID");
Transaction storage txn = transactions[_txId];
require(!txn.executed, "Transaction already executed");
if (msg.sender == owner1) {
require(txn.approvedByOwner1, "Not approved by owner1");
txn.approvedByOwner1 = false;
} else {
require(txn.approvedByOwner2, "Not approved by owner2");
txn.approvedByOwner2 = false;
}
emit TransactionDisapproved(_txId, msg.sender);
}

These changes would make the contract much safer for dating app users by giving them control over their approvals as relationship dynamics change.

Tools Used

Manual Review + Foundry Testing Framework

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Users mistake, only impacting themselves.

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.