Root Cause: The likeUser
function does not update userBalances
with the msg.value
(1 ETH) sent by users. As a result, the ETH remains in the contract's balance but is not tracked for reward distribution.
Impact:
Users lose their ETH as it is not allocated to their balances.
Matches result in zero rewards being sent to the MultiSig wallet.
ETH accumulates in the contract with no retrieval mechanism.
Recommendation:
Update userBalances
in likeUser
:
Ensure fees and rewards are calculated based on tracked balances.
Likelihood: High, always. Impact: High, loss of funds
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.