Summary

1. Due to the public nature of on-chain data, attackers can conduct targeted attacks on users with higher balances, paying 1 ETH to call likeUser in order to exploit potential gains;

2. Since each user can match with multiple users, the following situation may arise:

   1. userA likes userB

   2. userA likes userC

   3. userB likes userA

   4. userC likes userA

   5. Clearly, at this point userA's balance is 0, which is unfair for userC.

Vulnerability Details

Regardless of the difference between userBalances[from] and userBalances[to], they will always be fully cleared and counted towards totalRewards, which poses a potential phishing attack risk for high-net-worth users; on the other hand, this is also unfair to users who successfully match later.

Impact

• High-net-worth users may be targeted by an attacker, for example, a user with a balance of 100 ETH could be attracted and deceived by an attacker using multiple 1 ETH accounts.

• The attacker himself can also create multiple accounts from the start to fish, and the more these accounts are liked, the greater the potential gains for the attacker.

• The reward distribution mechanism is unfair to users who match later.

Tools Used

• Foundry

Recommendations

Modifying totalRewards to be calculated based on the user with the smaller balance not only helps defend against the aforementioned attacks but also prevents unfair situations.