Summary

The matchRewards() function in the LikeRegistry contract does not provide an accessible way for participants to obtain the multisigWallet address, which is essential for fund distribution. Since the multisigWallet is responsible for managing the financial transactions between matched users, its address is a critical piece of information. However, the contract currently does not explicitly expose this address to users, making it difficult for them to verify or interact with it without searching through blockchain explorers like Etherscan.

Vulnerability Details

When users are matched in LikeRegistry, they rely on matchRewards() to facilitate the distribution of funds via the multisigWallet. However, the contract does not provide a direct way for users to retrieve or verify the multisigWallet address. The only way to obtain this information is by manually searching through on-chain transactions on platforms like Etherscan. This process can be particularly challenging when transaction history is extensive, making it difficult for users to locate the correct contract address.

This lack of transparency can create confusion and delays in fund distribution, as users may struggle to determine where their funds are being sent and whether they have been properly matched. Since the multisigWallet address plays a crucial role in financial interactions, ensuring its visibility is essential for improving user experience and trust in the contract.

Impact

The absence of a clear way to obtain the multisigWallet address leads to unnecessary complexity for users. Participants who need to verify the contract’s legitimacy or interact with it directly may face difficulties in locating the correct address, potentially delaying the transaction process. This lack of transparency also increases the risk of errors, as users may inadvertently interact with the wrong contract due to misinformation or confusion.

Tools Used

Manual Audit

Recommendations

To improve accessibility and transparency, the contract should emit an event whenever matchRewards() is executed, explicitly providing the multisigWallet address to the matched participants. This allows users to easily retrieve the contract address from event logs rather than manually searching through transaction histories.