DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Fund Sent Directly to `LikeRegistry` Will Not be Able to Withdraw by Anyone

hirugohan

Summary

Due to missing handling of received funds which transferred directly to the contract address, it can lead to the funds unable to withdraw. Both user and the contract owner are unable to withdraw the fund being sent directly to the contract lead to a loss of fund.

Vulnerability Details

When a user send fund directly to LikeRegistry contract, it will do nothing and doen't account the fund to the user who send it.

/// @notice Allows the contract to receive ETH
receive() external payable {}

While we see there is a storage variable designed to store and account the user funds called userBalances.

contract LikeRegistry is Ownable {
[...]
​
mapping(address => mapping(address => bool)) public likes;
mapping(address => address[]) public matches;
mapping(address => uint256) public userBalances;
[...]

POC

function testSendMoneyToLikeRegistry() public {
uint256 sendAmount = 1 ether;
uint256 initialLikeRegistryFund = address(likeRegistry).balance;
​
// user send money directly to like registry contract
vm.prank(user);
(bool success,) = payable(address(likeRegistry)).call{value: sendAmount}("");
uint256 likeRegistryFundAfterFunded = address(likeRegistry).balance;
​
assertEq(success, true);
assertEq(initialLikeRegistryFund, 0);
assertEq(likeRegistryFundAfterFunded, sendAmount);
​
// check userBalances
uint256 userUserBalance = likeRegistry.userBalances(user);
assertEq(userUserBalance, sendAmount); // sending money directly to contract should adjust userBalance to reflect the address fund
​
// owner try to withdraw money
vm.prank(owner);
vm.expectRevert();
likeRegistry.withdrawFees(); // the contract will assume that there is no fees to withdraw
​
// try to withdraw money
vm.prank(user);
vm.expectRevert();
likeRegistry.withdrawFees(); // there is no withdraw function for user
}

Impact

  • Loss of fund because no one can withdraw it

Recommendations

Account the fund to address by storing it in the userBalances variable

- receive() external payable {}
+ receive() external payable {
+ userBalances[msg.sender] += msg.value;
+ }
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_receive_function

Not the best design, but if you send money accidentally, that's a user mistake. Informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.