DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Inability to Recover MultiSig Wallet Address

b13ss3d

Summary

The LikeRegistry contract deploys a MultiSigWallet contract for matched users but does not provide a way to recover the address of the deployed MultiSigWallet. This makes it difficult for users to interact with their multisig wallet without manually tracking the on-chain transactions.

Vulnerability Details

In the matchRewards function, a new MultiSigWallet contract is deployed for the matched users. However, the address of this newly deployed contract is not stored or made accessible through the LikeRegistry contract. This oversight forces users to manually track the on-chain transactions to find their multisig wallet address, which is not user-friendly and can lead to potential issues in accessing their funds.

Impact

  1. User Inconvenience: Users have to manually track the on-chain transactions to find their multisig wallet address, which is not user-friendly.

  2. Potential Loss of Funds: If users are unable to find their multisig wallet address, they may lose access to their funds.

  3. Operational Complexity: Increases the complexity of interacting with the LikeRegistry contract and the deployed MultiSigWallet contracts.

Tools Used

  • Manual code review

Recommendations

Implement a mapping in the LikeRegistry contract to store the addresses of the deployed MultiSigWallet contracts. This will allow users to easily retrieve their multisig wallet address.

mapping(address => mapping(address => address)) public multiSigWallets;
​
function matchRewards(address from, address to) internal {
uint256 matchUserOne = userBalances[from];
uint256 matchUserTwo = userBalances[to];
userBalances[from] = 0;
userBalances[to] = 0;
​
uint256 totalRewards = matchUserOne + matchUserTwo;
uint256 matchingFees = (totalRewards * FIXEDFEE) / 100;
uint256 rewards = totalRewards - matchingFees;
totalFees += matchingFees;
​
// Deploy a MultiSig contract for the matched users
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
multiSigWallets[from][to] = address(multiSigWallet);
multiSigWallets[to][from] = address(multiSigWallet);
​
// Send ETH to the deployed multisig wallet
(bool success,) = payable(address(multiSigWallet)).call{value: rewards}("");
require(success, "Transfer failed");
}
​
function getMultiSigWallet(address user1, address user2) external view returns (address) {
return multiSigWallets[user1][user2];
}
Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.