DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Unmatched Users Funds Are Forever Locked in likeRegistry contract

0xblackadam

Description

The LikeRegistry contract permanently locks user funds (1 ETH) when they like another user but never get matched. There is no mechanism to withdraw funds from unmatched likes, leading to permanent loss of user funds.

Users must pay 1 ETH to like another profile:

function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
likes[msg.sender][liked] = true;
emit Liked(msg.sender, liked);
​
// Funds only move to MultiSig if matched
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
// If no match, funds are locked forever
}

Impact:

  • Funds locked indefinitely if target never likes back

  • No refund mechanism for unmatched likes

  • Platform accumulates unclaimed ETH

Proof of Concept:

function testNoMatchScenario() public {
// Setup long-term scenario
address[5] memory users = [
makeAddr("user1"),
makeAddr("user2"),
makeAddr("user3"),
makeAddr("user4"),
makeAddr("user5")
];
// Fund users
for(uint i = 0; i < users.length; i++) {
vm.deal(users[i], 5 ether);
vm.prank(users[i]);
soulboundNFT.mintProfile(
string(abi.encodePacked("User", i+1)),
25,
string(abi.encodePacked("ipfs://user", i+1))
);
}
// Simulate multiple likes
for(uint i = 0; i < users.length; i++) {
vm.prank(users[i]);
likeRegistry.likeUser{value: 1 ether}(users[(i+1) % users.length]);
}
// Time passes...
vm.warp(block.timestamp + 365 days);
// Users have left platform
// 5 ETH permanently locked
assertEq(address(likeRegistry).balance, 5 ether);
// No recovery mechanism exists
}

Fix Recommendation

  • Add like expiration

  • Add refund/withdraw mechanism

Tools Used

  • Foundry Testing Framework

  • Manual Review

Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.