DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

After the user calls the `likeUser` function, the userBalance does not increase by the corresponding value.

ethanwalker

Summary

User A calls likeUser and sends value > 1 ETH. According to the design of DatingDapp, the amount for user A should be accumulated by userBalances. Otherwise, in the subsequent calculations, the balance for each user will be 0.

Vulnerability Details

When User A calls likeUser, the accumulation of userBalances is not performed.

function likeUser(
address liked
) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");
​
likes[msg.sender][liked] = true;
emit Liked(msg.sender, liked);
​
// Check if mutual like
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
}

This will result in totalRewards always being 0, affecting all subsequent calculations:

uint256 totalRewards = matchUserOne + matchUserTwo;
uint256 matchingFees = (totalRewards * FIXEDFEE ) / 100;
uint256 rewards = totalRewards - matchingFees;
totalFees += matchingFees;

POC

function testUserBalanceshouldIncreaseAfterLike() public {
vm.prank(user1);
likeRegistry.likeUser{value: 20 ether}(user2);
assertEq(likeRegistry.userBalances(user1), 20 ether, "User1 balance should be 20 ether");
}

Then we will get an error:

[FAIL: User1 balance should be 20 ether: 0 != 20000000000000000000]

Impact

  • Users will be unable to receive rewards.

  • The contract owner will also be unable to withdraw ETH from the contract.

Tools Used

  • Foundry

Recommendations

Add processing for userBalances in the likeUser function:

function likeUser(
address liked
) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");
​
likes[msg.sender][liked] = true;
+ userBalances[msg.sender] += msg.value;
emit Liked(msg.sender, liked);
​
[...]
}
Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.