DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Untracked MultiSigWallet contract Instances

merembablas

Summary

MultiSig deployed contract’s address is not recorded, it becomes difficult to track, interact with, or manage the created contracts.

Vulnerability Details

When a user likes and gets a match, LikeRegistry.sol:matchRewards function will deploy a new MultiSigWallet contract.

​
function matchRewards(address from, address to) internal {
[...]
​
// Deploy a MultiSig contract for the matched users
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
​
[...]
}
​

However, there is no record, event, or return value that represents the new deployed multiSigWallet address.

Impact

Severity: Medium

Operational Inefficiencies & Financial Risks

If multiSigWallet address need to be tracked later, external tools must scan blockchain transaction logs and adding complexity.

If the deployed contracts hold funds, they may become permanently inaccessible without proper tracking.

Tools Used

forge 1.0.0-dev

Recommendations

1. Store Contract Addresses in Mappings for Faster Lookups

To track deployed contracts, store their addresses in an mapping, allows users to query their own deployed contracts.

​
contract LikeRegistry is Ownable {
mapping(address => mapping(address => address )) public wallets;
​
[...]
​
}

Then, in the LikeRegistry.sol:matchRewards function, store the deployed contract address in wallets

​
function matchRewards(address from, address to) internal {
​
[...]
​
// Deploy a MultiSig contract for the matched users
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
​
wallets[from][to] = address(multiSigWallet); // @audit: store multiSigWallet address to wallets map
​
[...]
}

2. Use Events for Off-Chain Tracking

If on-chain storage is unnecessary, events can log deployed contract addresses:

​
contract LikeRegistry is Ownable {
event WalletDeployed(address from, address to, address multiSigWallet);
​
[...]
​
}

Then, emit WalletDeployed after MultiSigWallet contract created

​
function matchRewards(address from, address to) internal {
​
[...]
​
// Deploy a MultiSig contract for the matched users
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
​
emit WalletDeployed(from, to, address(multiSigWallet)); // @audit: emit WalletDeployed event
​
[...]
}
Updates

Appeal created

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.