Description
The LikeRegistry::likeUser()
function requires users to send 1 ETH when liking another user. However, the function never updates userBalances[msg.sender]
Impact
This results in users spending ETH without it being stored for future use in matchRewards(), leading to permanent fund loss if a match does not occur.
Proof of Concepts
Recommended mitigation
Add the following change to the code:
Likelihood: High, always. Impact: High, loss of funds
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.