DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Handling of Excess ETH Sent in `likeUser`

m3dython

  • Description:
    The requirement msg.value >= 1 ether means that callers can send more than 1 ETH, yet the contract does not explicitly handle any “excess” ETH. Without updating userBalances (see issue #1) or enforcing an exact value, users might inadvertently overpay.

  • Root Cause:
    The contract does not validate that exactly the expected amount is sent nor does it refund the surplus.

  • Impact:
    Users may lose funds they did not intend to commit if they accidentally send too much ETH, and the surplus is never properly accounted for or returned.

  • Recommendation:

    • Enforce an Exact Amount: If the intent is to charge exactly 1 ETH per like, change the requirement to:

      require(msg.value == 1 ether, "Must send exactly 1 ETH");

    • Or Refund Excess: Alternatively, if a deposit mechanism is intended, record the entire amount in userBalances and consider refunding any extra if necessary.

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Users mistake, only impacting themselves.

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.