DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Due to fees not being collected, the service suffers financial losses

loptus

Summary

Since balance updates are not performed, the fees are also not updated, resulting in the fees always remaining at 0 ETH.

Vulnerability Details

function withdrawFees() external onlyOwner {
require(totalFees > 0, "No fees to withdraw");
uint256 totalFeesToWithdraw = totalFees; // 0
​
totalFees = 0;
(bool success,) = payable(owner()).call{value: totalFeesToWithdraw}("");
require(success, "Transfer failed");
}

Since the user's userBalances are not updated, the matchingFees value is always set to 0. Consequently, totalFees also remains 0. Later, when the owner attempts to withdraw funds equal to totalFees through the withdrawFees() function, no funds can be withdrawn since totalFees is always 0.

Impact

Because users do not pay fees, there is financial harm to the service's operation

Recommendations

Update the balance when a user deposits 1 ether. Then, the fees are also updated

Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.