Summary

The likeUser function accepts ETH payments but fails to properly track and manage user balances, potentially leading to lost funds.

Vulnerability Details

When users send ETH to like another profile, the contract accepts the payment but doesn't update userBalances:

Impact

• User payments are accepted but not tracked

• When matches occur, the reward calculation will be incorrect

• Users could lose their deposited ETH

Tools Used

• Control flow analysis

• Balance tracking verification

• State management audit

Recommendations

1. Add balance tracking to likeUser function:

   function likeUser(address liked) external payable {

   require(msg.value >= 1 ether, "Must send at least 1 ETH");

   require(!likes[msg.sender][liked], "Already liked");

   // Track user balance

   userBalances[msg.sender] += msg.value;

   likes[msg.sender][liked] = true;

   emit Liked(msg.sender, liked);

   if (likes[liked][msg.sender]) {

   matches[msg.sender].push(liked);

   matches[liked].push(msg.sender);

   emit Matched(msg.sender, liked);

   matchRewards(liked, msg.sender);

   }

   }

2. Add function to allow users to withdraw their balances if they change their mind

3. Implement balance checks before processing matches