DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Multisig Wallet Address Disclosure

0xalipede

Summary

The LikeRegistry.sol::matchRewards() function deploys a multisig wallet for matched users and transfers their rewards to it. However, the function does not emit an event or return the address of the deployed multisig wallet. This omission prevents users from knowing where their rewards were sent, impacting usability and transparency.

Vulnerability Details

Affected code

After calling matchRewards(), the deployed multisig wallet's address is unknown to the users because it is neither emitted in an event nor returned by the function. This creates a usability issue where users cannot access their rewards without external assistance.

Impact

  • Users have no way to retrieve their multisig wallet address unless they manually track transactions on-chain.

  • Lack of transparency in reward distribution could lead to user frustration and distrust.

  • The issue could lead to support requests and an increased operational burden for developers.

Tools Used

  • Manual review

Recommendations

Emit an event with the multisig wallet address:

event MultiSigWalletCreated(address indexed userOne, address indexed userTwo, address wallet);

Modify the function:

function matchRewards(address from, address to) internal {
...
​
// Deploy a MultiSig contract for the matched users
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
​
// Send ETH to the deployed multisig wallet
(bool success,) = payable(address(multiSigWallet)).call{value: rewards}("");
require(success, "Transfer failed");
emit MultiSigWalletCreated(from, to, address(multiSigWallet));
}

Alternatively, return the multisig wallet address from the function.

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.