DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

User A can spend >1 ETH to like another user's profile

0xcryptanu

Summary

There is no strict restriction to the amount of ETH that prospective lovers pool together in the multisig wallet.

Vulnerability Details

require(msg.value >= 1 ether, "Must send at least 1 ETH");

Due to this check being for msg.value being greater or equal to 1 ether any user can contribute much more than 1 ETH to the multisig wallet when it is created. Say UserA contributes 4 ETH and a prospective lover pools their 1 ETH to the multisig, they could enjoy a 5-star platinum date instead of a coffee chat to get to know each other.

Impact

Unfair contributions per user could cause users to spend more on the first date than expected.

Tools Used

Manual Review

Recommendations

- require(msg.value >= 1 ether, "Must send at least 1 ETH");
+ require(msg.value >= 1 ether, "Must send at least 1 ETH");
Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Users mistake, only impacting themselves.

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.