Description: When a user likes another user, the Ether sent is not credited to userBalances.
This leads to a series of issues: when two users successfully match,
the Ether contributed by both does not get transferred to their multi-signature wallet,
and the owner is unable to withdraw the funds, since the totalFees is based on 10% charge from matching fee.
Impact: the matching logic is broken, no eth is transferred to the multi-signature wallet. no eth is added to totalFees
Proof of Concept:
create a test file LikeRegistryTest.t.sol with the following code
pragma solidity ^0.8.19;
import {Test, console, Vm} from 'forge-std/Test.sol';
import {LikeRegistry} from "src/LikeRegistry.sol";
import {SoulboundProfileNFT} from "src/SoulboundProfileNFT.sol";
import {MultiSigWallet} from "src/MultiSig.sol";
contract LikeRegistryTest is Test {
SoulboundProfileNFT soulboundNFT;
LikeRegistry likeRegistry;
address ownerOfNFT = makeAddr("ownerOfNFT");
address ownerOfLike = makeAddr("ownerOfLike");
address bob = makeAddr("bob");
address alice = makeAddr("alice");
address roxas = makeAddr("roxas");
uint256 constant INITIAL_BALANCE = 100 ether;
function setUp() public {
vm.prank(ownerOfNFT);
soulboundNFT = new SoulboundProfileNFT();
vm.prank(ownerOfLike);
likeRegistry = new LikeRegistry(address(soulboundNFT));
vm.prank(bob);
soulboundNFT.mintProfile("Bob", 25, "ipfs://bobPhoto");
vm.prank(alice);
soulboundNFT.mintProfile("Alice", 23, "ipfs://alicePhoto");
vm.deal(bob, INITIAL_BALANCE);
vm.deal(alice, INITIAL_BALANCE);
vm.deal(roxas, INITIAL_BALANCE);
}
...
function testUserBalanceIsNotUpdated() public {
uint256 bobBalanceBefore = likeRegistry.userBalances(bob);
vm.prank(bob);
likeRegistry.likeUser{value: 2 ether}(alice);
uint256 bobBalanceAfter = likeRegistry.userBalances(bob);
assertEq(bobBalanceBefore, bobBalanceAfter);
}
}
then run the test, the assertion indicates that the balance is not updated
Recommended Mitigation:
add update logic into the likeUser function
function likeUser(address liked) external payable{
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");
+ userBalances[msg.sender] += msg.value;
likes[msg.sender][liked] = true;
emit Liked(msg.sender, liked);
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
}
