DatingDapp

First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Submission Details
Severity: high
Valid

### [H-1] State variable `LikeRegistry::userBalances` , Leading to Incorrect `LikeRegistry::matchRewards` Calculations

### [H-1] State variable `LikeRegistry::userBalances` , Leading to Incorrect `LikeRegistry::matchRewards` Calculations
**Description:**
In the LikeRegistry contract, users are required to send at least 1 ETH when calling the likeUser function. However, the sent value (msg.value) is not recorded or assigned to the sender's balance in the userBalances mapping. Later on, when a mutual like is detected, the matchRewards function attempts to distribute rewards based on the values stored in userBalances for both users. Since these balances remain at their default value (zero), the reward distribution logic is effectively broken—the users receive no rewards, and the reward mechanism does not work as intended.
**Impact:**
1. Incorrect Reward Calculation: As userBalances are never updated with the ETH sent, matchRewards always computes the reward as zero.
2. User Dissatisfaction: Users who pay ETH expecting to receive rewards on a mutual match may end up with no funds being distributed, leading to confusion and potential loss of trust in the platform.
3. Potential Fund Mismanagement: Although the ETH sent is held by the contract (or possibly used elsewhere), the intended reward flow is compromised, which may lead to further complications in fund management.
**proof of code:**
1. write contract to test LikeRegistry.
2. Have 2 users with souldboundedProfile nft call `LikeRegistry::likeUser` which mutually liking each other profile so `LikeRegistry::matchRewards` is called
3. Then the reansaction fails as `LikeRegistry::userBalances[address]` returns zero
Updates

Appeal created

n0kto Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.