DatingDapp

Summary

The business logic of the contract does not encourage someone to like more than one soulmate. If someone uses the app with malicious intentions, it becomes very easy to steal or lock others user's funds.

Vulnerability Details

Let's explain with the following cenario:

1. User1 likes three others different soulmates with no match. The user must pay a minimum of 3 eth (1 eth for each like).

2. User2 likes user 1 by paying 1 eth and they match.

3. A multisig wallet is created with a balance of 3.6 eth. (userBalance[user1] + userBalance[user2]) - 10% fee.

4. Now, user2 controls the eth deposited from user1 that is locked inside the new multisig wallet.

5. If they disagree and want to split up, user 2 might lock the funds of user1 forever or only agree to withdraw if user2 keeps 50%, for example.

In a scenario where an attacker creates multiple ProfileNFTs and starts liking random users, the chances are high that the attacker will match with someone who has given at least two likes, making it almost guaranteed to profit.

Impact

It becomes very easy for an attacker to lock or steal legitimate users' funds.

Tools Used

Manual Review

Recommendations

To ensure that no financial gain is the final goal, the multisig wallet must be created with an equal contribution from both individuals. There are several ways to achieve this, and here are two examples:

1. The multisig wallet is created with 1 ETH from each account.

2. The wallet is created using the lowest userBalance between the two, and the wallet is funded with this value contributed by both individuals.

For example:

• If userBalance[user1] == 5 ETH

• And userBalance[user2] == 3 ETH

• The multisig wallet is created with 6 ETH, 3 eth from user2 and 3 eth from user1 (before any fee calculation).

These methods ensure that neither user is incentivized to match or outbid the other for financial gain.