DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

If a user remains unmatched they tend to risk their funds being stuck in the contract

riceee

Vulnerability Details

In the current implementation of the DatingDapp protocol, users must pay 1 ETH to like someone. However, if a user never finds a match, their previous deposits remain permanently locked within the contract. Since there is no function allowing users to withdraw their funds, this creates a "once entered, no going back until match found" situation where funds become irretrievable if no matches are found.

Impact

Users who do not receive a match have no way to recover their ETH, leading to a poor user experience and financial loss.
Users may be hesitant to participate in the protocol due to the risk of losing funds if they are not matched.

Mitigation

To address this issue, an unlikeUser function should be implemented. This function allows users to revoke their like and recover their 1 ETH deposit if they are unmatched. Something like this:

function unlikeUser(address unliked) external {
require(likes[msg.sender][unliked], "Never liked");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(unliked) != 0, "Unliked user must have a profile NFT");
​
likes[msg.sender][unliked] = false;
emit Unliked(msg.sender, unliked);
​
// Refund the 1 ETH
(bool success, ) = msg.sender.call{value: 1 ether}("");
require(success, "Refund failed");
}

Benefits of This Fix

  • Prevents Fund Lockup: Users who are not matched can retrieve their ETH.

  • Enhances User Experience: Allows users to control their interactions and make decisions freely.

  • Improves Protocol Trust: Encourages more users to engage with the platform without fear of losing their funds.

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.