DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

User deposits are never accounted for in LikeRegistry::likeUser leading to a complete lock of the deposited funds and failure of protocol

riceee

Vulnerability Details

The LikeRegistry::likeUser function does not track the ETH deposited by users when they like someone. This results in an issue where, during a potential match, the matchRewards function attempts to pool ETH from the userBalances mapping, but since userBalances is never updated, the pooled balance remains zero. Consequently, the ETH sent by users remains locked in the contract permanently with no mechanism for withdrawal.

Impact

  • Permanent ETH Lockup: Users' ETH payments remain trapped in the contract, with no function allowing withdrawals.

  • Empty MultiSig Wallets: Since matchRewards relies on userBalances, all MultiSig wallets created will have a zero balance, making them unusable.

  • Protocol Failure: The DatingDapp protocol specifies that matched users should receive a pooled balance in a shared MultiSig wallet. However, due to this bug, the intended feature does not function correctly.

Recommendations

Update userBalances in likeUser

Modify the function to track ETH deposits correctly:

function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");
userBalances[msg.sender] += 1 ether; //<--- Add the Missing Line
​
likes[msg.sender][liked] = true;
emit Liked(msg.sender, liked);
​
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
​
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
}
Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_likeUser_no_userBalances_updated

Likelihood: High, always. Impact: High, loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.