DatingDapp

Summary

The `LikeRegistry::matchRewards` function fails to process fees correctly because user balances are never updated in the `LikeRegistry::likeUser` function. When users send ETH via `likeUser()`, the value is not recorded in the `LikeRegistry::userBalances` mapping. as a result, when `matchRewards` is calling during a match, it processes zero balances instead of the actual ETH sent by users

Vulnerability Details

```solidity

function testIncorrectFeeCalculation() public {

vm.deal(user1, 2 ether);

vm.deal(user2, 2 ether);

uint256 initialOwnerBalance = owner.balance;

vm.prank(user1);

likeRegistry.likeUser{value: 1 ether}(user2);

vm.prank(user2);

likeRegistry.likeUser{value: 1 ether}(user1);

vm.prank(owner);

vm.expectRevert();

likeRegistry.withdrawFees();

uint256 totalFees = owner.balance - initialOwnerBalance;

assertEq(totalFees, 0); // This checks if no fees were withdrawn (0)

}

```

Impact

High

Tools Used

foundry

Recommendations

Update `LikeRegistry::likeUser` to track sent ETH

```diff

function likeUser(address liked) external payable {

// ... existing checks ...

+ userBalances[msg.sender] += msg.value;

likes[msg.sender][liked] = true;

// .... existing code ...

}

```