DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Fee Calculation

rare__one

Summary

The FIXEDFEE in LikeRegistry.sol is set to 10 (10%), but fees are deducted even when totalRewards is 0 due to uncredited userBalances. This results in:

  • Fees calculated as (0 * 10%) = 0, wasting gas on multisig deployments.

  • Potential underflow if userBalances are negative (though prevented by Solidity 0.8’s safemath).

Proof of Concept

  1. Alice and Bob match, but totalRewards = 0.

  2. Contract deploys a multisig and sends 0 ETH to it.

  3. Gas is wasted on deployment for no value.

Vulnerability Details

Impact

  • Unnecessary gas costs for deploying empty multisig contracts.

  • Protocol earns no fees, undermining revenue model.

Tools Used

Recommendations

Add validation to skip fee logic if totalRewards = 0

if (totalRewards == 0) revert NoRewards();
Updates

Appeal created

n0kto Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.