Submission Details
Severity:
User's funds are not updated in `LikeRegistry` contract when user like anyone.
Description
When user like anyone by calling `LikeRegistry::like` function by sending `1 ETH`, The `LikeRegistry::userBalances` is not updated. Which lead to raise problem to make matching and create `Multisig wallet` for users, And missing of `fees` which will be send to the `owner` due to this owner is unable to get `fees`.
Impact
Missing funds and fees in contract which lead to lock the funds in contract. Due to this issue users can not make matching `multisig wallet` and `owner` won't be able to get any `fees`.
Proof of Concept
Add this into the `testLikeRegistry.t.sol` file after creating that file.
Proof Of Code:
Test the `testUserFundsAreNotUpdated` function
```javascript
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
import {Test} from "forge-std/Test.sol";
import {LikeRegistry} from "../src/LikeRegistry.sol";
import {SoulboundProfileNFT} from "../src/SoulboundProfileNFT.sol";
contract testLikeRegistry is Test {
LikeRegistry likeRegistry;
SoulboundProfileNFT profileNFT;
address user1 = makeAddr("user1");
address user2 = makeAddr("user2");
address owner = makeAddr("owner");
function setUp() public {
vm.startPrank(owner);
profileNFT = new SoulboundProfileNFT();
likeRegistry = new LikeRegistry(address(profileNFT));
vm.stopPrank();
vm.deal(user1, 10 ether);
vm.deal(user2, 10 ether);
}
function testLikeUser() public {
vm.prank(user1);
profileNFT.mintProfile("Alice", 25, "ipfs://profileImage");
vm.prank(user2);
profileNFT.mintProfile("Bob", 25, "ipfs://profileImage");
vm.prank(user1);
likeRegistry.likeUser{value: 1 ether}(user2);
assertTrue(likeRegistry.likes(user1, user2), "User1 should like User2");
}
function testUserCanLikeBySendingMoreUnnesseseryETH() public {
vm.prank(user1);
profileNFT.mintProfile("Alice", 25, "ipfs://profileImage");
vm.prank(user2);
profileNFT.mintProfile("Bob", 25, "ipfs://profileImage");
vm.prank(user1);
likeRegistry.likeUser{value: 9 ether}(user2);
assertEq(address(likeRegistry).balance, 9 ether);
}
function testUserFundWillLockedForInfiniteTime() public {
vm.prank(user1);
profileNFT.mintProfile("Alice", 25, "ipfs://profileImage");
vm.prank(user2);
profileNFT.mintProfile("Bob", 25, "ipfs://profileImage");
vm.prank(user1);
likeRegistry.likeUser{value: 1 ether}(user2);
//There is no options or function to unlike user2.
}
function testUserFundsAreNotUpdated() public {
vm.prank(user1);
profileNFT.mintProfile("Alice", 25, "ipfs://profileImage");
vm.prank(user2);
profileNFT.mintProfile("Bob", 25, "ipfs://profileImage");
vm.prank(user1);
likeRegistry.likeUser{value: 1 ether}(user2);
assertEq(likeRegistry.userBalances(user1), 0, "User1 balance should be 0");
assertEq(likeRegistry.userBalances(user2), 0, "User2 balance should be 0");
assertEq(address(likeRegistry).balance, 1 ether);
}
}
```
Result:
```javascript
[PASS] testUserFundsAreNotUpdated() (gas: 375617)
Traces:
[375617] testLikeRegistry::testUserFundsAreNotUpdated()
├─ [0] VM::prank(user1: [0x29E3b139f4393aDda86303fcdAa35F60Bb7092bF])
│ └─ ← [Return]
├─ [166182] SoulboundProfileNFT::mintProfile("Alice", 25, "ipfs://profileImage")
│ ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: user1: [0x29E3b139f4393aDda86303fcdAa35F60Bb7092bF], tokenId: 1)
│ ├─ emit ProfileMinted(user: user1: [0x29E3b139f4393aDda86303fcdAa35F60Bb7092bF], tokenId: 1, name: "Alice", age: 25, profileImage: "ipfs://profileImage")
│ └─ ← [Stop]
├─ [0] VM::prank(user2: [0x537C8f3d3E18dF5517a58B3fB9D9143697996802])
│ └─ ← [Return]
├─ [144282] SoulboundProfileNFT::mintProfile("Bob", 25, "ipfs://profileImage")
│ ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: user2: [0x537C8f3d3E18dF5517a58B3fB9D9143697996802], tokenId: 2)
│ ├─ emit ProfileMinted(user: user2: [0x537C8f3d3E18dF5517a58B3fB9D9143697996802], tokenId: 2, name: "Bob", age: 25, profileImage: "ipfs://profileImage")
│ └─ ← [Stop]
├─ [0] VM::prank(user1: [0x29E3b139f4393aDda86303fcdAa35F60Bb7092bF])
│ └─ ← [Return]
├─ [31014] LikeRegistry::likeUser{value: 1000000000000000000}(user2: [0x537C8f3d3E18dF5517a58B3fB9D9143697996802])
│ ├─ [627] SoulboundProfileNFT::profileToToken(user1: [0x29E3b139f4393aDda86303fcdAa35F60Bb7092bF]) [staticcall]
│ │ └─ ← [Return] 1
│ ├─ [627] SoulboundProfileNFT::profileToToken(user2: [0x537C8f3d3E18dF5517a58B3fB9D9143697996802]) [staticcall]
│ │ └─ ← [Return] 2
│ ├─ emit Liked(liker: user1: [0x29E3b139f4393aDda86303fcdAa35F60Bb7092bF], liked: user2: [0x537C8f3d3E18dF5517a58B3fB9D9143697996802])
│ └─ ← [Stop]
├─ [2561] LikeRegistry::userBalances(user1: [0x29E3b139f4393aDda86303fcdAa35F60Bb7092bF]) [staticcall]
│ └─ ← [Return] 0
├─ [0] VM::assertEq(0, 0, "User1 balance should be 0") [staticcall]
│ └─ ← [Return]
├─ [2561] LikeRegistry::userBalances(user2: [0x537C8f3d3E18dF5517a58B3fB9D9143697996802]) [staticcall]
│ └─ ← [Return] 0
├─ [0] VM::assertEq(0, 0, "User2 balance should be 0") [staticcall]
│ └─ ← [Return]
├─ [0] VM::assertEq(1000000000000000000 [1e18], 1000000000000000000 [1e18]) [staticcall]
│ └─ ← [Return]
└─ ← [Stop]
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 43.08ms (7.65ms CPU time)
```
Recommended Mitigation
The users balance should be updated properly when they like anyone.
Add This suggestions in the `LikeRegistry` contract.
```diff
function likeUser(
address liked
) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");
+ userBalances[msg.sender] = msg.value;
likes[msg.sender][liked] = true;
emit Liked(msg.sender, liked);
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
}
```
Updates
Appeal created
n0kto 8 months ago
Submission Judgement Published Assigned finding tags:
finding_likeUser_no_userBalances_updated
Likelihood: High, always. Impact: High, loss of funds
Rewards breakdown
nSLOC
197This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.