Submission Details
Severity:
Never updated user balances prevent matches from sending their ETH to their multisig and protocol from withdrawing fees
Summary
Never updated user balances prevent matches from sending their ETH to their multisig and protocol from withdrawing fees. The userBalances variable should be updated in the likeUser(...) function but it is not.
Vulnerability Details
function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");
likes[msg.sender][liked] = true;
emit Liked(msg.sender, liked);
// @audit should add: userBalances[msg.sender] += msg.value;
// Check if mutual like
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
}
function matchRewards(address from, address to) internal {
uint256 matchUserOne = userBalances[from]; // @audit this is 0
uint256 matchUserTwo = userBalances[to]; // @audit this is 0
userBalances[from] = 0;
userBalances[to] = 0;
uint256 totalRewards = matchUserOne + matchUserTwo; // @audit this is 0
uint256 matchingFees = (totalRewards * FIXEDFEE) / 100; // @audit this is 0
uint256 rewards = totalRewards - matchingFees; // @audit this is 0
totalFees += matchingFees; // @audit this is 0
// Deploy a MultiSig contract for the matched users
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
// Send ETH to the deployed multisig wallet
(bool success,) = payable(address(multiSigWallet)).call{value: rewards}(""); // @audit this is 0
require(success, "Transfer failed");
}
//...
function withdrawFees() external onlyOwner {
require(totalFees > 0, "No fees to withdraw"); // @audit this line will revert
//...
}
Impact
Funds are locked in the contract, matches will not have a multisig with funds, owner cannot withdraw the fees.
Tools Used
Manual review
Recommendations
Update userBalances in the likeUser(...) function.
Updates
Appeal created
n0kto 7 months ago
Submission Judgement Published Assigned finding tags:
finding_likeUser_no_userBalances_updated
Likelihood: High, always. Impact: High, loss of funds
Rewards breakdown
nSLOC
197This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.