DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Truncation happens in `matchingFees` variable calculation in `LikeRegistry::matchRewards` function.

xilobytes

Description

In LikeRegistry::matchRewards, the matching fee is calculated as (totalRewards * FIXEDFEE) / 100. However, since Solidity performs integer division, any decimal values are truncated instead of rounded, leading to small amounts of ETH being lost.

Impact

The fee calculation is inaccurate, reducing platform revenue due to round down truncation.

Proof of Concepts

  • User A and user B both like each other, adding up a total rewards of 2 ETH

  • matchingFees is calculated as (2 * 10) / 100 = (20 / 100)

  • The result is truncated to 0, when it had to be calculated as 0.2 ETH

Recommended mitigation

Add the following change to the code:

function matchRewards(address from, address to) internal {
uint256 matchUserOne = userBalances[from];
uint256 matchUserTwo = userBalances[to];
userBalances[from] = 0;
userBalances[to] = 0;
​
- uint256 totalRewards = matchUserOne + matchUserTwo;
+ uint256 totalRewards = (matchUserOne + matchUserTwo) * 10 ** 18;
- uint256 matchingFees = (totalRewards * FIXEDFEE ) / 100;
+ uint256 matchingFees = (totalRewards) / FIXEDFEE;
uint256 rewards = totalRewards - matchingFees;
totalFees += matchingFees;
​
// Deploy a MultiSig contract for the matched users
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
​
// Send ETH to the deployed multisig wallet
(bool success, ) = payable(address(multiSigWallet)).call{value: rewards}("");
require(success, "Transfer failed");
}
Updates

Appeal created

n0kto Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.