Missing user balance tracking leads to zero rewards in match system
Description:
The LikeRegistry contract fails to track user balances when they send ETH through the likeUser function. While the contract receives ETH payments, it never updates the userBalances mapping. As a result, when users match and the matchRewards function is called, it operates with zero balances, effectively losing all user funds.
Impact:
Users lose all ETH sent to the contract when liking profiles
Match rewards are always calculated as zero
The MultiSig wallet created for matched pairs receives no funds
Breaks core protocol functionality of pooling likes into shared wallets
Recommended Mitigation:
Add balance tracking in the likeUser function:
Appeal created
finding_likeUser_no_userBalances_updated
Likelihood: High, always. Impact: High, loss of funds
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.