DatingDapp

Summary

In LikeRegistry.sol, the calculation of rewards in the matchRewards() function is flawed. Instead of summing up the ETH transferred specifically for the mutual "like" between the two matched users, it sums up the total balances of both users. This can result in incorrect reward distribution.

Vulnerability Details

The matchRewards() function calculates rewards as the sum of userBalances[from] and userBalances[to]. However:

• The balances (userBalances) include all ETH sent by the users for liking others, not just the ETH relevant to this specific match.

• This can lead to:

  • Over-rewarding: When a user has sent ETH to like other users, their balance is incorrectly included in the reward pool for this match.

  • Under-rewarding: If other matches deplete a user’s balance before this match is processed, the rewards for this match will be lower than expected.

Example Scenario

1. User A sends 2 ETH to like User B and 1 ETH to like User C. User B sends 1 ETH to like User A.

2. When A and B match, matchRewards() will incorrectly use the entire balance of User A (3 ETH) and User B (1 ETH) instead of just the 2 ETH and 1 ETH relevant to their mutual likes.

Impact

• Rewards may not accurately reflect the ETH transferred for the specific match.

• Users could receive rewards that are either higher or lower than expected.

• Potential disputes or loss of trust from users due to incorrect reward distribution.

Tools Used

• Manual code review

• Test scenario design to analyze edge cases

Recommendations

1. Track ETH transferred for each individual "like" interaction. Update the likes mapping to include the amount sent:

   mapping(address => mapping(address => uint256)) public likeAmounts;

2. Modify the likeUser() function to record the ETH amount sent for the specific "like":

   likeAmounts[msg.sender][liked] = msg.value;

3. Update the matchRewards() function to use the amounts specifically transferred for the mutual "like":

   uint256 rewards = likeAmounts[from][to] + likeAmounts[to][from];

   likeAmounts[from][to] = 0;

   likeAmounts[to][from] = 0;

4. If userBalances are still needed, ensure they are updated properly in likeUser() but exclude irrelevant balances during reward calculations.