Funds not transferred to the created multisig wallets, stuck in `LikeRegistry.sol`
Summary
In LikeRegistry::likeUser(), the funds are being transferred by the user to the contract. However, the userBalances[msg.sender] is not being updated, which leads to the msg.sender's balance always being zero.
Vulnerability Details
This is a critical vulnerability as every user's funds are impacted here with no way to withdraw them, not even by the owner.
Impact
This would lead to a complete loss of funds for every user interacting with the DApp as the multisig created on being matched would have zero funds every time.
Tools Used
Manual Review
Recommendations
Update the userBalances in the likeUser() function.
Appeal created
finding_likeUser_no_userBalances_updated
Likelihood: High, always. Impact: High, loss of funds
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.