DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect Reward Calculation Due to Shared User Balances in matchRewards()

0xalipede

Summary

The LikeRegistry.sol::matchRewards() function incorrectly calculates rewards when a user has liked multiple users. This can lead to improper reward distribution and unintended fund allocation.

Vulnerability Details

Affected code

The contract uses a single userBalances mapping (mapping(address => uint256)) to track deposited ETH per user. However, users can like multiple profiles, increasing their balance without tracking who the ETH was meant for.

Consider the following scenario:

  1. Alice likes Bob → deposits 1 ETH

  2. Alice likes Josh → deposits 1 ETH

    • userBalances[Alice] = 2 ETH

  3. Bob likes Alice back → match triggers matchRewards(Alice, Bob)

    • matchRewards assumes Alice’s entire balance (2 ETH) belongs to Bob

    • Incorrect totalRewards = 3 ETH (instead of expected 2 ETH - fees)

This flaw misallocates funds, leading to incorrect transfers to the wrong multisig wallet and potential fund mismanagement.

Impact

  • Users' ETH gets miscalculated and sent incorrectly.

  • Matched users may receive ETH that belongs to an unrelated pending match.

  • Other users may lose their deposited ETH unfairly.

Tools Used

  • Manual review

Recommendations

Upgrade the userBalances mapping in the LikeRegistry.sol to a nested one. This ensures deposits are tracked per liked user, preventing unrelated funds from being included in a match.

mapping(address => mapping(address => uint256)) public userBalances;
​
function likeUser(address liked) external payable {
...
​
userBalances[msg.sender][liked] += msg.value;
​
likes[msg.sender][liked] = true;
emit Liked(msg.sender, liked);
...
}
​
​
function matchRewards(address from, address to) internal {
uint256 matchUserOne = userBalances[from][to];
uint256 matchUserTwo = userBalances[to][from];
userBalances[from][to] = 0;
userBalances[to][from] = 0;
​
...
}
Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
0xalipede Submitter
6 months ago
n0kto Lead Judge
6 months ago
n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.