No like cancellation mechanism results in permanent fund lock
Description:
The LikeRegistry contract lacks functionality for users to cancel their likes and retrieve their ETH. Once a user sends 1 ETH to like another profile, there's no way to undo this action, even if it was made by mistake:
The contract permanently stores the like status in the likes mapping and holds the ETH without any cancellation or refund mechanism.
Impact:
Users cannot recover funds from accidental likes
ETH becomes permanently locked until a match occurs
No way to handle cases of misclicked profiles
Recommended Mitigation:
Implement a like cancellation mechanism with a time lock
Appeal created
Users mistake, only impacting themselves.
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.