DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

No Tracking of MultiSig Wallet Deployments

blockchain_oracle

H-4 No Tracking of MultiSig Wallet Deployments

The LikeRegistry::matchRewards() function deploys MultiSig wallets and sends funds to them, but there is no way to track which MultiSig wallets were deployed for which matches. This makes it impossible to:

  1. Verify where user funds were sent which puts user funds at risk

  2. Look up the MultiSig wallet address for a given match

Proof of Concept

function matchRewards(address from, address to) internal {
uint256 matchUserOne = userBalances[from];
uint256 matchUserTwo = userBalances[to];
userBalances[from] = 0;
userBalances[to] = 0;
​
uint256 totalRewards = matchUserOne + matchUserTwo;
uint256 matchingFees = (totalRewards * FIXEDFEE) / 100;
uint256 rewards = totalRewards - matchingFees;
totalFees += matchingFees;
​
// Deploy a MultiSig contract for the matched users
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
​
// Send ETH to the deployed multisig wallet
(bool success,) = payable(address(multiSigWallet)).call{value: rewards}("");
require(success, "Transfer failed");
}

Code Mitigation

To track MultiSig wallet deployments, we can add an event that emits the addresses of both matched users and the deployed MultiSig wallet address. This provides several benefits:

  1. Transparency - Users can verify which MultiSig wallet was created for their match by looking up events

  2. Auditability - The full history of MultiSig deployments is recorded on-chain

  3. Frontend Integration - dApps can easily fetch and display MultiSig wallet addresses for users

  4. Debugging - Makes it easier to track down issues by having a clear record of deployments

event Liked(address indexed liker, address indexed liked);
event Matched(address indexed user1, address indexed user2);
+ event MultiSigWalletDeployed(address indexed from, address indexed to, address indexed multiSigWallet);
function matchRewards(address from, address to) internal {
// ... existing code ...
+ emit MultiSigWalletDeployed(from, to, address(multiSigWallet));
}
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.