DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Untracked MultiSigWallet Deployment Leads To Potential Funds Lockup

d4r3_w0lf

Summary

In the LikeRegistry contract, when two users mutually like each other, a MultiSigWallet contract is deployed with both users as owners. However, the contract does not provide a way for users to retrieve the address of the deployed MultiSigWallet, leading to potential funds lockup.

Vulnerability Details

Once the MultiSigWallet contract is deployed, neither the contract nor the users can track or retrieve its address. This results in users not knowing where their funds have been sent.

Root Cause :

  • Lack of Address Storage: The contract does not store the deployed MultiSigWallet address.

  • No Retrieval Mechanism: Users cannot fetch the address via a function or event.

Vulnerable code location can be find here github

Impact

  • Funds Locked: Any ETH sent to the wallet may become inaccessible unless users manually track deployed contract addresses using blockchain explorers.

  • Loss of Accessibility: Users cannot interact with their MultiSigWallet instance because they do not know its address.

Tools Used

  • Manual Review

  • Unit Testing

Recommendations

Store the MultiSig Address in a Mapping:

+ mapping(address => mapping(address => address)) public multiSigWallets;
.
.
.
function matchRewards(address from, address to) internal {
uint256 matchUserOne = userBalances[from];
uint256 matchUserTwo = userBalances[to];
userBalances[from] = 0;
userBalances[to] = 0;
​
uint256 totalRewards = matchUserOne + matchUserTwo;
uint256 matchingFees = (totalRewards * FIXEDFEE ) / 100;
uint256 rewards = totalRewards - matchingFees;
totalFees += matchingFees;
​
// Deploy a MultiSig contract for the matched users
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
+ multiSigWallets[from][to] = address(multiSigWallet);
+ multiSigWallets[to][from] = address(multiSigWallet);
// Send ETH to the deployed multisig wallet
(bool success, ) = payable(address(multiSigWallet)).call{value: rewards}("");
require(success, "Transfer failed");
}
​
​
+ function getMultiSigWallet(address user1, address user2) external view returns (address) {
+ return multiSigWallets[user1][user2];
+ }
Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.