DatingDapp

Summary

Vulnerability Details

The likeUser function in LikeRegistry.sol in the contract requires users to send 1 ETH when liking another user. However, if the liked user does not reciprocate the like, the ETH remains trapped in the contract indefinitely. There is no mechanism to refund the sender, resulting in a loss of funds for users who interact with the contract. Over time, this issue could lead to significant amounts of ETH being permanently locked, causing financial losses and damaging user trust.

Impact

Impact Analysis

1. Permanent Loss of Funds

   • Users who send 1 ETH but do not receive a like in return will never get their ETH back, resulting in financial loss.

   • Over time, as more users interact with the system, substantial amounts of ETH will accumulate in the contract with no way to retrieve it.

2. Negative User Experience and Reputation Damage

   • Users expecting a fair system will feel misled and financially exploited, reducing trust in the platform.

   • If users recognize that their ETH can be permanently lost, engagement with the platform will decrease.

3. Contract Becomes a Black Hole for ETH

   • ETH sent in unsuccessful likes has no exit path, meaning funds accumulate indefinitely without any beneficiary.

   • This violates good smart contract design principles, where every incoming ETH should have a clear recipient or refund mechanism.

4. Potential Exploitation for Financial Gain

   • The contract deployer or malicious actors could artificially generate likes to trap ETH, exploiting unsuspecting users.

   • If a user knows they will not reciprocate likes, they could profit indirectly from the vulnerability by encouraging others to like them.

POC

Proof of Concept (PoC)

Reproducing the Issue

1. User A attempts to like User B by sending 1 ETH:

2. User B does not like back.

3. User A cannot withdraw their ETH because no refund function exists.

4. ETH remains locked inside the contract permanently.

Test Result:

• ETH is sent to the contract.

• If likes[userB][userA] remains false, there is no function allowing userA to withdraw their ETH.

• The contract retains all ETH without any exit strategy.

Tools Used

manual review

Recommendations

1. Implement a Refund Mechanism

Introduce a function allowing users to withdraw their 1 ETH if the liked user does not reciprocate within a set timeframe.