DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Users' funds can be Trapped

dexcripter

Users funds can be trapped

Vulnerability Details

In the multisig contract created after two users share a mutual like, user's funds can potentially be trapped forever.

Let's say a scenario where User 1, who is paired with User 2 looses access to his wallet. User 2 will become unable to withdraw their funds forever. This is a bug in the protocols design since both users must consent to a transaction before it can be processed.

Impact

This is a severe design issue that affects the core functionality of the protocol, and poses great risks to users funds.

Tools Used

Manual review

Recommendations

Introduce two new features,

  • A timelock in contract that approves a transaction after a certain time has elapsed.

  • A new cancelTransaction function that allows users to cancel a transaction, preventing it from reaching the set timelock value.

​
struct Transaction {
address to;
uint256 value;
bool approvedByOwner1;
bool approvedByOwner2;
bool executed;
uint256 timelock;
}
​
uint256 public constant timelock = 1 weeks;
​
function submitTransaction(address _to, uint256 _value) external onlyOwners {
if (_to == address(0)) revert InvalidRecipient();
if (_value == 0) revert InvalidAmount();
​
transactions.push(Transaction(_to, _value, false, false, false, timelock));
uint256 txId = transactions.length - 1;
emit TransactionCreated(txId, _to, _value);
}
​
// cancel a transaction if one of the user does not consent to the transaction,
// that way the `timelock` dosent automatically trigger it.
function cancelTransaction(uint256 _txId) external onlyOwners {
require(_txId < transactions.length, "Invalid transaction ID");
Transaction storage txn = transactions[_txId];
require(!txn.executed, "Transaction already executed");
​
delete transactions[_txId];
// maybe emit a new event if needed
}
​
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.