DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Funds sent to `LikeRegistry::receive` are locked forever

stratan

Summary

LikeRegistry::receive allows the contract to receive ETH but they can't be used or withdrawn in any way.

Vulnerability Details

Based on the code, LikeRegistry::receive allows the contract to receive ETH.

/// @notice Allows the contract to receive ETH
receive() external payable {}

However, should an app user, (or any contract address in fact), decide to fund the contract, the ETH would be locked forever as there's no functionality that makes use of them.

Proof of Concept

The following PoC demonstrates the said bug. Place test_AnyoneCanFundLikeRegistryContract in testSoulboundProfileNFT.t.sol:

function test_AnyoneCanFundLikeRegistryContract() public {
LikeRegistry likeRegistry = new LikeRegistry(address(soulboundNFT));
address user = makeAddr("user");
vm.deal(user, 5 ether);
vm.prank(user);
(bool success, ) = payable(address(likeRegistry)).call{value: 1 ether}(
""
);
require(success, "Transfer failed");
assertEq(address(likeRegistry).balance, 1 ether);
}

Impact

Loss of funds

Tools Used

Manual review, tests

Recommendations

According to the docs, effective payments should be made through LikeRegistry::likeUser. Since any other source of funds (i.e via receive) isn't used in any way, it's best to remove the functionality overall to prevent the funds from getting locked. Should the app dev decide to integrate receive's funds in the future, she should consider keeping track of ETH payments in receive, implement proper access control so that non-registered users can't fund the contract, as well as the ability to withdraw funds.

Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_receive_function

Not the best design, but if you send money accidentally, that's a user mistake. Informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.