DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`LikeRegistry::userBalances` is never updated, which interferes with user access to funds

vanshikag

Summary

The LikeRegistry::userBalances mapping keeps a record of user balances. A user's balance is supposed to be increased by the value sent by other users in the LikeRegistry::likeUser function, for a minimum of 1 ether per like. This value is used by the LikeRegistry::matchRewards function to calculate the amount to be given to the users' multiSig wallet in case of a match. The balance for every user remains zero throughout the contract because it is never updated.

Impact

Users do not have access to the funds they receive from likes, and cannot use the multiSig wallet functionality that the app promises.

Proof of Concept

testUserBalanceUpdate below proves that the balance of the user receiving the like is never updated, even though the value is deducted from the user calling the function.

contract LikeRegistryTest is Test {
SoulboundProfileNFT soulboundNFT;
LikeRegistry likeRegistry;
address user = address(0x123);
address user2 = address(0x456);
address owner = address(this); // Test contract acts as the owner
​
function setUp() public {
soulboundNFT = new SoulboundProfileNFT();
likeRegistry = new LikeRegistry(address(soulboundNFT));
vm.prank(user);
soulboundNFT.mintProfile('Alice', 25, 'ipfs://image');
vm.prank(user2);
soulboundNFT.mintProfile('Ben', 25, 'ipfs://image');
vm.deal(user, 5 ether);
}
function testUserBalanceUpdate() public {
// testing the userBalances mapping used for accounting in the contract.
uint256 balanceBefore = likeRegistry.userBalances(user2);
console.log("user balance before liking user2:", user.balance); // 5 ETH
vm.prank(user);
likeRegistry.likeUser{value: 1 ether}(user2);
uint256 balanceAfter = likeRegistry.userBalances(user2);
console.log("user balance after liking user2:", user.balance); // 4 ETH
assertEq(balanceBefore, balanceAfter, "userBalances are never updated"); // passes
}
}

Tools Used

VSCode, Foundry

Recommendations

In the LikeRegistry::likeUserfunction, update LikeRegistry::userBalances for the receiver by the value sent in the transaction.

+ userBalances[liked] += msg.value;

If the value of each like is fixed, counting the number of likes received can be another method to calculate user balance.

Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.