Summary

Scope: src/LikeRegistry.sol

In the likeUser function, users send ETH (1 ETH minimum), but the contract never updates userBalances[msg.sender]

Vulnerability Details

1. Missing Balance Tracking:

   • In the likeUser function, users send ETH (1 ETH minimum), but the contract never updates userBalances[msg.sender].

   • The ETH is sent to the contract, but userBalances remains at 0 because there's no code to store the deposited ETH in the user's balance.

2. matchRewards Relies on Empty Balances:

   • When mutual likes occur, matchRewards reads userBalances[from] and userBalances[to], which are both 0 since the balances were never updated.

   • This leads to totalRewards = 0 + 0 = 0, resulting in zero rewards and fees.

Impact

The userBalances not being updated causes the userBalances[x] , totalRewards , matchingFees , rewards and totalFees in the matchRewards function to always be 0 thus breaking the logic of the application for the pooled payments.

Tools Used

Remix IDE,
Manual Static Analysis

Recommendations