DatingDapp
AI First Flight #6
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

[M] Missing On-Chain Mapping for Match Multisig Wallets

huicanvie

Root + Impact

Description

  • After both parties have mutually liked each other, both balances will be transferred into a newly generated multisignature wallet, which the users can use to manage the multisig wallet balance.

  • Currently, after dynamically generating a multi-signature wallet, the wallet address is not being recorded, which impedes user accessibility.

// Root cause in the codebase with @> marks to highlight the relevant section
function matchRewards(address from, address to) internal {
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
@> This can be used to record wallet addresses.
}

Risk

Likelihood: Medium

  • The issue is likely to occur in real usage because a new multisig wallet is deployed for each match, but no direct on-chain mapping or wallet-address event is provided for users to reliably discover their specific reward wallet. In practice, users and integrators must depend on off-chain indexing, transaction tracing, or custom tooling to recover the wallet address, which is error-prone and not guaranteed across all clients. As match volume grows, the chance of users failing to locate and manage their reward wallet increases significantly.


Impact:Medium

  • Matched users may be unable to reliably locate the specific multisig wallet that holds their pooled date funds, because the protocol does not persist or expose a direct on-chain mapping from user-pair to deployed wallet address. This breaks practical fund accessibility: users can be matched and funds can be transferred, yet they cannot consistently identify or operate the wallet needed to spend those funds. The impact is amplified with repeated matches and higher activity, where wallet discovery becomes increasingly error-prone and dependent on off-chain indexing infrastructure.


Recommended Mitigation

  1. Add a mapping to record the multisig wallet address bidirectionally.

  2. In the matchRewards function, record after generating the multi-signature wallet.

  3. Add a new query function to allow users to look up their multisig wallet addresses.

+ mapping(address => mapping(address => address)) public matchWalletByUsers;
​
function matchRewards(address from, address to) internal {
​
MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);
+ matchWalletByUsers[from][to] = address(multiSigWallet);
+ matchWalletByUsers[to][from] = address(multiSigWallet);
}
​
+ function getMyMatchWallet(address matchedUser) external view returns (address) {
+ return matchWalletByUsers[msg.sender][matchedUser];
+ }
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!