DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

userBalances Not Updated in LikeRegistry Contract

b13ss3d

Summary

The LikeRegistry contract's matchRewards function relies on the userBalances mapping to calculate rewards for matched users. However, the userBalances mapping is never updated, resulting in zero balances and no rewards being distributed.

Vulnerability Details

In the matchRewards function, the userBalances mapping is used to retrieve the balances of the matched users. These balances are then used to calculate the total rewards and fees. However, the userBalances mapping is never updated in the contract, meaning that the balances will always be zero.

Impact

No Rewards Distributed: Since userBalances is never updated, the balances will always be zero, resulting in no rewards being distributed to the matched users. Also the platform will not collect the intended fees from the rewards, impacting the revenue model.

Tools Used

  • Manual code review

Recommendations

Ensure that the userBalances mapping is updated appropriately when users interact with the contract. For example, update the balances when users send ETH to like another user.

function likeUser(address liked) external payable nonReentrant {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");
​
likes[msg.sender][liked] = true;
+ userBalances[msg.sender] += msg.value; // Update user balance
emit Liked(msg.sender, liked);
​
// Check if mutual like
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
}
Updates

Appeal created

n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.