DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Users Cannot Access Funds in MultiSig Wallet Due to Missing Address Retrieval

pablitoamaral

Description

The matchRewards() function creates a MultiSigWallet for two matched users, but it does not store or expose the wallet's address. This results in a critical issue, as users cannot find their wallet or interact with their funds.

Impact

  • The MultiSig Wallets become completely inaccessible, making the feature useless.

Tools Used

Manual

Proof of Concept

function matchRewards(address from, address to) internal {
uint256 matchUserOne = userBalances[from];
uint256 matchUserTwo = userBalances[to];
userBalances[from] = 0;
userBalances[to] = 0;
​
uint256 totalRewards = matchUserOne + matchUserTwo;
uint256 matchingFees = (totalRewards * FIXEDFEE) / 100;
uint256 rewards = totalRewards - matchingFees;
totalFees += matchingFees;
​
// Deploy a MultiSig contract for the matched users
@> // The multiSigWallet is not stored anynwhere
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
​
// Send ETH to the deployed multisig wallet
(bool success,) = payable(address(multiSigWallet)).call{value: rewards}("");
require(success, "Transfer failed");
}

Recommendations

1- Store the MultiSig wallet address in a mapping for easy retrieval:

mapping(address => address[]) public userMultiSig;
function matchRewards(address from, address to) internal {
//...
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
userMultiSig[from].push(address(multiSigWallet));
userMultiSig[to].push(address(multiSigWallet));
}

2- Emit an event when creating a MultiSig wallet:

event MultiSigCreated(address indexed user1, address indexed user2, address wallet);
Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.