Multisig wallets could be stored and mapped to users
Summary
Users get matched and a new multisig wallet gets created but the multisig address is not made public.
Vulnerability Details
When users get matched and a new multisig is generated, it is not broadcasted in an event leaving the users in the dark to where the contract containing the ETH for their date is expected to be. Unless the users can comb through the transaction logs to find the newly created contract address, the ETH stored in the contract could be locked there with limited chance of withdrawal.
Impact
Can cause a denial of service.
Poor UX
Tools Used
Manual Review
Recommendations
Track the multisig wallets created.
Emit events containing the address of the multisig wallet.
Appeal created
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.