DatingDapp

Summary

• ETH sent when liking someone isn't stored if the like isn't mutual immediately. This may lead to fund loss** **or locked funds. when someone likes another user and sends ETH, if the like isn't mutual immediately, the ETH isn't stored and could be lost. The code provided doesn't track that ETH unless it's mutual. So the problem is that the ETH isn't stored anywhere in that case. The Likeregistry::likeUser() function requires 1 ETH. If the liked user hasn't liked back yet (so not mutual), the code checks if likes[liked][msg.sender] is true. If not, the ETH isn't handled anywhere else. There's no mapping or variable storing the sent ETH unless it's mutual. ETH is just sent to the contract but not recorded, so the user can't get it back if the other person never likes them back.

Vulnerability Details

• The original contract lacks a mechanism to:

  1. Track ETH sent during non-mutual likes (likeBalances mapping missing)

  2. Allow ETH recovery for unrequited likes (retrieveETH function missing)

Proof Explanation

The tests demonstrate that:

• 100% of ETH is locked forever if the like remains unrequited

• Users have no recourse to recover funds

• Contract balance permanently grows with failed matches

Impact

This may lead to fund loss or locked funds.

Tools Used

manual Review

Recommendations

Track ETH per like using userBalances[msg.sender] += msg.value;