DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

User Balance stuck in LikeRegistry contract

adityamohan0502

Summary :

When a user (Alice) expresses interest in another user (Bob) by calling the LikeRegistry::likeUser function, the msg.value is not properly accounted for, causing the value to be stuck in the contract without being recorded in LikeRegistry::userBalances.

Vulnerability Details:

When Alice calls the LikeRegistry::likeUser function, passing Bob's address and sending 1e18 ETH, the value is not recorded in the userBalances mapping. Consequently, when Bob reciprocates the like with another 1e18 ETH, a multisig is created, but it starts with a balance of 0, as value was not recorded.

POC:

To reproduce the issue, add the following test case in the testSoulboundProfileNFT.t.sol file.

import {LikeRegistry} from "../src/LikeRegistry.sol";
.
.
.
​
function setUp() public {
soulboundNFT = new SoulboundProfileNFT();
likeRegistry = new LikeRegistry(address(soulboundNFT));
vm.deal(user,10e18);
vm.deal(user2,10e18);
}
​
.
.
.
.
​
function testLikedUserBalance() public {
vm.prank(user);
soulboundNFT.mintProfile("Alice", 25, "ipfs://profileImage");
​
vm.prank(user2);
soulboundNFT.mintProfile("Bob", 25, "ipfs://profileImage");
​
vm.prank(user);
likeRegistry.likeUser{value:1e18}(user2);
​
assertEq(likeRegistry.userBalances(user),1e18);
}
​

Impact:

User balances remain stuck in the LikeRegistry contract indefinitely.

Tools Used:

. Foundry

Recommendations:

Modify the LikeRegistry::likeUser function to correctly update the userBalances mapping:

​
likes[msg.sender][liked] = true;
+ userBalances[msg.sender] += msg.value;
emit Liked(msg.sender, liked);
​
// Check if mutual like
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
​
Updates

Appeal created

n0kto Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.