DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

User Balances Not Tracked, Causing Reward Distribution Failure.

guzbyte

Summary

The matchRewards function in the LikeRegistry contract attempts to distribute rewards based on userBalances. However, user balances are never updated, meaning the reward calculation always results in zero rewards and zero fees.

Vulnerability Details

User balances are not tracked; they are only read from storage because they were not initially assigned in the likeUser function.

uint256 matchUserOne = userBalances[from];
uint256 matchUserTwo = userBalances[to];

Since userBalances[from] and userBalances[to] are never updated in the contract, they are always zero.

Consequences

totalRewards = matchUserOne + matchUserTwo = 0 + 0 = 0
matchingFees = (totalRewards * FIXEDFEE) / 100 = (0 * 10) / 100 = 0
rewards = totalRewards - matchingFees = 0 - 0 = 0
This means no actual ETH is transferred to the MultiSig wallet, and the total fee accumulation remains zero.

Impact

  • Users receive no rewards when they match, making the matching mechanism ineffective.

  • The contract owner cannot withdraw any fees because totalFees is always zero.

  • Funds sent to the contract remain untracked and potentially locked if not properly withdrawn.

POC

function testUserBalanceNotTrack() public {
vm.prank(user); // Simulates user calling the function
likeRegistry.likeUser{value: 1 ether}(user2); // User 1 likes User 2
assertTrue(likeRegistry.likes(user, user2));
​
// Simulates user calling the function to trigger the match matchRewards function
vm.prank(user2);
likeRegistry.likeUser{value: 1 ether}(user); // User 1 likes User 2
assertTrue(likeRegistry.likes(user2, user));
​
uint256 userOneBalance = likeRegistry.userBalances(user);
uint256 userTwoBalance = likeRegistry.userBalances(user2);
​
assertEq(userOneBalance, 0);
assertEq(userTwoBalance, 0);
}
Ran 1 test for test/testLikeRegistry.t.sol:SoulboundProfileNFTTest
[PASS] testUserBalanceNotTrack() (gas: 710628)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 9.29ms (1.78ms CPU time)
​
Ran 1 test suite in 390.89ms (9.29ms CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)

Tools Used

Manual Code Review
Foundry

Recommendations

  • Track user deposits by updating userBalances when users send ETH during the likeUser function
    userBalances[msg.sender] += msg.value;

Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.