DatingDapp

Summary

abi.encodePacked() should not be used with dynamic types when passing the result to a hash function such as keccak256().

Vulnerability Details

Use abi.encode() instead which will pad items to 32 bytes, which will prevent hash collisions (e.g. abi.encodePacked(0x123,0x456) => 0x123456 => abi.encodePacked(0x1,0x23456), but abi.encode(0x123,0x456) => 0x0...1230...456). Unless there is a compelling reason, abi.encode should be preferred. If there is only one argument to abi.encodePacked() it can often be cast to bytes() or bytes32() instead. If all arguments are strings and or bytes, bytes.concat() should be used instead.

Impact

Tools Used

. Aderyn

Recommendations

Use bytes.concat() for String and Byte Concatenation

If concatenation is necessary, use bytes.concat() instead of abi.encodePacked().