DatingDapp

Summary

Since likes are not being reset after a match, the LikeRegistry contract allows users to have multiple matches. However, only the first match will receive funds because userBalances are reset to zero after each match.

Vulnerability Details

1. Likes Not Being Deleted: In the likeUser function, when a mutual like is detected, the matchRewards function is called to distribute rewards. However, the likes are not being deleted after a match is made, allowing users to have multiple matches with the same user.

2. Zero Funds for Subsequent Matches: The userBalances are reset to zero after the first match, resulting in zero funds for subsequent matches. This means that only the first match will have funds, while subsequent matches will have zero funds.

Impact

1. Zero Funds for Subsequent Matches: Only the first match will have funds, while subsequent matches will have zero funds due to the userBalances being reset to zero.

2. User Dissatisfaction: Users may be dissatisfied if they expect rewards from multiple matches but only receive funds for the first match.

Tools Used

• Manual code review

Recommendations

1. Delete Likes After Matching: Ensure that likes are deleted after a match is made to prevent multiple matches with the same user.

2. Update userBalances Appropriately: Ensure that userBalances are updated correctly to reflect the funds available for each match.