DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Since there is no mechanism to update the mapping `LikeRegistry::userBalances`, its value remains `0`; which breaks the functionality of `matchRewards`

fairytales

Description:

The LikeRegistry::matchRewards function is intended to transfer reward to multisig wallet of the users. It takes 10% fee from the sum of balances of user1 and user2. But, there is no mechanism tho update LikeRegistry::userBalances and it remains 0 forever. This breaks the functionality of matchRewards, as LikeRegistry::totalRewards will be 0, thus LikeRegistry::matchingFees will be 0.

uint256 totalRewards = matchUserOne + matchUserTwo;
uint256 matchingFees = (totalRewards * FIXEDFEE) / 100;

This will make rewards which will be transferred to multisig wallet 0 as well.

uint256 rewards = totalRewards - matchingFees;

Impact:

No reward will be transferred to multisig wallet. No fees will be collected because of this.

Recommended Mitigation:

  1. Consider adding a function, so that users can deposit funds and the change gets reflected in userBalances mapping.

  2. Consider adding a check to totalRewards, such that it can't be zero.

Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.