DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

User Balance not updated

epintos

Summary

The likeUser method is not updating the liked user's balance.

Vulnerability Details

When a user likes another user the likeUser is not updating the liked user balance with the deposited ETH. The internal function matchRewards function does calculates the fees and rewards is assuming the userBalances[from] and userBalances[to] is positive. If two users match, then both the rewards and fees would be zero.

Impact

The match users won't get the accumulated balance in the MultiSig and the contract owner won't get the fees for the match.

Tools Used

  • Manual Review

  • Unit test

function testLikeUserUpdatesUserBalance() public {
vm.prank(user);
soulboundNFT.mintProfile("Alice", 25, "ipfs://profileImage");
​
vm.prank(user2);
soulboundNFT.mintProfile("Bob", 30, "ipfs://profileImage");
​
vm.prank(user);
registry.likeUser{value: 1 ether}(user2);
assertEq(registry.userBalances(user2), 1 ether);
}

Recommendations

Increment the liked user's balance:

function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");
​
likes[msg.sender][liked] = true;
emit Liked(msg.sender, liked);
​
userBalances[liked] += msg.value; // <----- Fix
​
// Check if mutual like
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
}
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.