Submission Details
Severity:
LikeRegistry: Missing Balance Updates in `likeUser`
[High] LikeRegistry: Missing Balance Updates in likeUser
ETH is sent but not tracked in userBalances, leading to lost funds.
Impact: Users lose funds when sending ETH to like others.
Proof of Concept:
function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
@> // Missing: userBalances[msg.sender] += msg.value
likes[msg.sender][liked] = true;
}
Recommended Mitigation: Add balance tracking:
+ userBalances[msg.sender] += msg.value;
Updates
Appeal created
n0kto 6 months ago
Submission Judgement Published Assigned finding tags:
finding_likeUser_no_userBalances_updated
Likelihood: High, always. Impact: High, loss of funds
Rewards breakdown
nSLOC
197This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.