DatingDapp

First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Submission Details
Severity: high
Valid

Unaccounted ETH in `LikeRegistry` Leading to Stuck Funds

  • Root Cause: The likeUser function does not update userBalances with the msg.value (1 ETH) sent by users. As a result, the ETH remains in the contract's balance but is not tracked for reward distribution.

  • Impact:

    • Users lose their ETH as it is not allocated to their balances.

    • Matches result in zero rewards being sent to the MultiSig wallet.

    • ETH accumulates in the contract with no retrieval mechanism.

  • Recommendation:

    • Update userBalances in likeUser:

      userBalances[msg.sender] += msg.value; // Add this line in the likeUser function
    • Ensure fees and rewards are calculated based on tracked balances.

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.