DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

LikeRegistry::likeUser Does Not Update userBalances, Leading to User Funds Being Locked

zebra

Summary

LikeRegistry::likeUser Does Not Update userBalances, Leading to User Funds Being Locked

Vulnerability Details

The likeUser function in the LikeRegistry contract does not update the userBalances mapping. As a result, when two users like each other, the matchRewards function creates a MultiSigWallet with a 0 balance. Additionally, the withdrawFees function only withdraws the amount stored in totalFees, which remains 0. Consequently, there is no mechanism to retrieve the funds deposited by users, leading to a permanent lock of user funds within the LikeRegistry contract.

Impact

  • Users' funds become permanently locked in the contract.

  • The matchRewards function creates empty MultiSigWallet contracts.

  • The withdrawFees function remains ineffective, as totalFees is never updated.

Proof of Concepts

Add a testLikeRegistry.t.sol file under the test folder. And add the following code.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
​
import "forge-std/Test.sol";
import "../src/LikeRegistry.sol";
import "../src/SoulboundProfileNFT.sol";
import {console} from "forge-std/console.sol";
​
contract LikeRegistryTest is Test {
LikeRegistry likeRegistry;
SoulboundProfileNFT soulboundProfileNFT;
address user = address(0x123);
address user2 = address(0x456);
address owner = address(this); // Test contract acts as the owner
​
function setUp() public {
soulboundProfileNFT = new SoulboundProfileNFT();
likeRegistry = new LikeRegistry(address(soulboundProfileNFT));
​
vm.prank(user);
soulboundProfileNFT.mintProfile("user", 50, "url1");
vm.stopPrank();
​
vm.prank(user2);
soulboundProfileNFT.mintProfile("user2", 50, "url2");
vm.stopPrank();
}
​
function testLikeUser() public {
uint256 user2Balance = likeRegistry.userBalances(user2);
assertEq(user2Balance, 0, "User2 Balance is 0");
​
vm.deal(user, 5 ether);
vm.prank(user);
likeRegistry.likeUser{value: 1 ether}(user2);
vm.stopPrank();
// assertEq(user2Balance > 0, true, "User2 Balance updated");
console.log("user1 balance", likeRegistry.userBalances(user));
console.log("user2 balance", likeRegistry.userBalances(user2));
}
}

Run

forge test --mt testLikeUser -vv

This test demonstrates that after a user sends 1 ether via likeUser, the userBalances mapping for both users remain unchanged.

Tools Used

N/A

Recommendations

Modify the likeUser function to correctly update the userBalances mapping when a user sends funds

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.