DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing userBalances update mechanism in the likeUser function of the LikeRegistry contract

denisturgenev2021

Summary

The LikeRegistry contract in its current form has a functionality for users to "like" each other and matchRewards when mutual likes occur. However, the likeUser function lacks a mechanism to update the userBalances mapping, which tracks the balance of each user.
As a result, when a mutual like happens and the contract attempts to send balances to the deployed multisig wallet in the matchRewards function, it will not be able to calculate accurate balances and may lead to can't send balances to the multisig wallet.

Vulnerability Details

Missing Update to userBalances in likeUser Function
The contract has a userBalances mapping, which is designed to track the balance of each user in the contract.
When a user "likes" another, they send ETH to the contract. This ETH should be added to the liking user's balance, but this step is missing from the likeUser function.
The matchRewards function relies on the balances stored in userBalances to calculate the rewards when two users mutually like each other. Since userBalances is not updated in likeUser, can't send to multisig wallet.

Impact

This vulnerability can make it impossible to send balances to multisig wallets.

ETH remains in the contract state permanently.

Tools Used

I manually review the code using VS Code.

Recommendations

** Update** userBalances in likeUser Function

The most immediate solution is to update the userBalances mapping when a user likes another. Specifically, the balance of the sender (the "liker") should be incremented by the ETH they send when calling the likeUser function.

function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");
​
likes[msg.sender][liked] = true;
+ userBalances[msg.sender] += msg.value; // Update user balance for the liker
emit Liked(msg.sender, liked);
​
// Check if mutual like
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
}
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.