Submission Details
Severity:
User can send more then one `ETH` to like anyone for unneccesery fund transfer of `ETH` to the contract in `LikeRegistry::likeUser` function.
Description
As doccumenation given there is mentioned that if anyone want to like anyone then he/she should send 1 ETH. But in`LikeRegistry::likeUser` function user can send very much amount of `ETH` which is not following the provided doccumentation.
Impact
User can send more then 1 ETH to anyone exidently or on their own desire which doean not following the protocol.
Proof of Concept
Make `testLikeRegistry.t.sol` file in `test` folder.
Add this test in that file.
Proof Of Code:
```javascript
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
import {Test} from "forge-std/Test.sol";
import {LikeRegistry} from "../src/LikeRegistry.sol";
import {SoulboundProfileNFT} from "../src/SoulboundProfileNFT.sol";
contract testLikeRegistry is Test {
LikeRegistry likeRegistry;
SoulboundProfileNFT profileNFT;
address user1 = makeAddr("user1");
address user2 = makeAddr("user2");
address owner = makeAddr("owner");
function setUp() public {
vm.startPrank(owner);
profileNFT = new SoulboundProfileNFT();
likeRegistry = new LikeRegistry(address(profileNFT));
vm.stopPrank();
vm.deal(user1, 10 ether);
vm.deal(user2, 10 ether);
}
function testLikeUser() public {
vm.prank(user1);
profileNFT.mintProfile("Alice", 25, "ipfs://profileImage");
vm.prank(user2);
profileNFT.mintProfile("Bob", 25, "ipfs://profileImage");
vm.prank(user1);
likeRegistry.likeUser{value: 1 ether}(user2);
assertTrue(likeRegistry.likes(user1, user2), "User1 should like User2");
}
function testUserCanLikeBySendingMoreUnnesseseryETH() public {
vm.prank(user1);
profileNFT.mintProfile("Alice", 25, "ipfs://profileImage");
vm.prank(user2);
profileNFT.mintProfile("Bob", 25, "ipfs://profileImage");
vm.prank(user1);
likeRegistry.likeUser{value: 9 ether}(user2);
assertEq(address(likeRegistry).balance, 9 ether);
}
}
```
Recommended Mitigation
Should implement check for sending `ETH`.
```diff
function likeUser(
address liked
) external payable {
- require(msg.value >= 1 ether, "Must send at least 1 ETH");
+ require(msg.value == 1 ether, "Must send at least 1 ETH");
```
Updates
Appeal created
n0kto 6 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Users mistake, only impacting themselves.
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Rewards breakdown
nSLOC
197This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.