DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing balance update leads to fund freeze

merembablas

Summary

A vulnerability was found in the LikeRegistry.sol:likeUser function where user balances are not properly recorded. This flaw causes the user rewards and total fees to be calculated as 0, resulting in a potential freeze of funds for both users and the protocol owner.

Vulnerability Details

The function likeUser(address liked) in LikeRegistry.sol contract does not update user balances userBalances properly, cause rewards and totalFees calculation to zero.

Below is the affected code:

function matchRewards(address from, address to) internal {
uint256 matchUserOne = userBalances[from];
uint256 matchUserTwo = userBalances[to];
​
[...]
​
uint256 totalRewards = matchUserOne + matchUserTwo;
uint256 matchingFees = (totalRewards * FIXEDFEE) / 100;
uint256 rewards = totalRewards - matchingFees;
totalFees += matchingFees;
​
[...]
}

Protocol owner call withdrawFees() to withdraw fees. totalFees that always has zero value make it revert.

function withdrawFees() external onlyOwner {
require(totalFees > 0, "No fees to withdraw");
uint256 totalFeesToWithdraw = totalFees;
​
totalFees = 0;
(bool success, ) = payable(owner()).call{value: totalFeesToWithdraw}(
""
);
require(success, "Transfer failed");
}

Impact

  1. Severity: High.

  2. Users will lose their reward.

  3. The protocol owner will lose control over all user deposits and fees.

Tools Used

forge 1.0.0-dev

Recommendations

Modify the likeUser(address liked) function to update user balances userBalances:

contract LikeRegistry is Ownable {
[...]
​
function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(
profileNFT.profileToToken(msg.sender) != 0,
"Must have a profile NFT"
);
require(
profileNFT.profileToToken(liked) != 0,
"Liked user must have a profile NFT"
);
​
likes[msg.sender][liked] = true;
+ userBalances[msg.sender] = userBalances[msg.sender] + msg.value;
emit Liked(msg.sender, liked);
​
// Check if mutual like
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
}
​
​
[...]
}
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.