DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

LikeRegistry: Owner Cannot Withdraw All Funds From Contract

alekseyts

[High] LikeRegistry: Owner Cannot Withdraw All Funds From Contract

If someone sends ETH directly to the contract via the receive function, or if a user's profile is blocked/deleted, these funds become locked in the contract. The current withdrawFees function only allows withdrawal of fees collected from matches (totalFees), but not other ETH that might be in the contract.

Impact: Contract owner cannot access all funds in the contract.
User funds become permanently locked if their profile is blocked/deleted.
ETH sent directly to contract via receive() becomes permanently locked.

Proof of Concept:

// Can only withdraw totalFees
function withdrawFees() external onlyOwner {
require(totalFees > 0, "No fees to withdraw");
uint256 totalFeesToWithdraw = totalFees;
​
totalFees = 0;
(bool success,) = payable(owner()).call{value: totalFeesToWithdraw}("");
require(success, "Transfer failed");
}
​
// ETH can be sent directly here and become locked
receive() external payable {}

Recommended Mitigation: Add mapping and event:

function withdrawFunds(uint256 amount) external onlyOwner {
require(amount <= address(this).balance, "Insufficient balance");
(bool success,) = payable(owner()).call{value: amount}("");
require(success, "Transfer failed");
}
​
// track blocked/deleted user balances separately
mapping(address => uint256) public deletedProfileBalances;
​
function blockProfile(address user) external onlyOwner {
// ... existing code ...
deletedProfileBalances[user] = userBalances[user];
userBalances[user] = 0;
}
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_blocking_or_burning_no_refund_balances_or_multisig

Likelihood: Low, burning with money in it would be a user mistake, and being blocked is Low. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.