DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

ETH Payments Not Tracked in userBalances

404bs

Summary

The likeUser function in LikeRegistry.sol does not credit sent ETH to the sender's userBalances, causing all user funds to be permanently locked in the contract.

Vulnerability Details

In LikeRegistry.sol, when a user sends 1 ETH via likeUser, the ETH is stored in the contract's balance, but no code updates userBalances[msg.sender]. Consequently, during mutual matches (matchRewards), the calculation uses userBalances[from] and userBalances[to], which remain at 0. This results in 0 ETH being sent to the multisig wallet, while the actual ETH remains stuck in LikeRegistry.

Affected Code:

// LikeRegistry.sol
function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
// Missing: userBalances[msg.sender] += msg.value;
...
}

Impact

All ETH sent by users is irrecoverably locked in the contract. Matched users receive no funds, violating the core protocol logic.

Tools Used

Manual code audit.

Recommendations

Add the following line to likeUser to track payments:

userBalances[msg.sender] += msg.value;
Updates

Appeal created

n0kto Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.