Submission Details
Severity:
userBalances are never updated thereby causing users lose their funds
Summary
likeUser::LikeRegistry.solrequires users to deposit 1 eth or above. The function fails to update the user balance which leads wrong accounting in calculation of totalFees.
Vulnerability Details
Poc
function echidna_balance_greater_1() public view returns (bool) {
return userBalances[msg.sender] >0;
}
the above echidna would always return false, same as below
function echidna_match_rewards()public view returns (bool){
return totalFees > 0;
}
Impact
leads to wrong calculation of totalFees, reward and other values tat depend on the userbalances
Tools Used
manual review
Recommendations
userBalances should be updated when they deposit funds
Updates
Appeal created
n0kto 7 months ago
Submission Judgement Published Assigned finding tags:
finding_likeUser_no_userBalances_updated
Likelihood: High, always. Impact: High, loss of funds
Rewards breakdown
nSLOC
197This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.