DatingDapp
AI First Flight #6
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

User like payments are never credited

joshuapaul1

Root + Impact

Description

  • likeUser() accepts at least 1 ether, but never increments userBalances[msg.sender]. Later, matchRewards() reads userBalances[from] and userBalances[to], zeros them, calculates rewards/fees from those values, and sends the result to the newly deployed multisig.

  • Because balances are always zero:

    • users pay ETH into LikeRegistry;

    • matching creates a MultiSigWallet funded with 0;

    • totalFees remains 0;

    • the ETH paid through likeUser() has no withdrawal path.

function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");
​
likes[msg.sender][liked] = true;
emit Liked(msg.sender, liked);
​
// Check if mutual like
if (likes[liked][msg.sender]) {
matches[msg.sender].push(liked);
matches[liked].push(msg.sender);
emit Matched(msg.sender, liked);
matchRewards(liked, msg.sender);
}
}

Risk

Likelihood:

  • The Multisig wallet created in matchRewards() is credited with ether from both user's balances but the balance isn't updated when liking each other's profile, meaning the wallet's balance remains zero so likelihood is high.


Impact:

  • The impact is High as it could lock out the user's Eth from being withdrawn.


Proof of Concept

It proves the first issue by having Alice and Bob each pay 1 ether to like each other. After the mutual match:

  • LikeRegistry still holds 2 ether

  • both userBalances are 0

  • withdrawFees() reverts with "No fees to withdraw"

contract LikeRegistryStuckFundsPoC is Test {
SoulboundProfileNFT profileNFT;
LikeRegistry likeRegistry;
​
address alice = address(0xA11CE);
address bob = address(0xB0B);
​
function setUp() public {
profileNFT = new SoulboundProfileNFT();
likeRegistry = new LikeRegistry(address(profileNFT));
​
vm.deal(alice, 1 ether);
vm.deal(bob, 1 ether);
​
vm.prank(alice);
profileNFT.mintProfile("Alice", 25, "ipfs://alice");
​
vm.prank(bob);
profileNFT.mintProfile("Bob", 26, "ipfs://bob");
}
​
function testPoC_MutualLikePaymentsRemainStuckInRegistry() public {
vm.prank(alice);
likeRegistry.likeUser{value: 1 ether}(bob);
​
vm.prank(bob);
likeRegistry.likeUser{value: 1 ether}(alice);
​
assertEq(address(likeRegistry).balance, 2 ether);
assertEq(likeRegistry.userBalances(alice), 0);
assertEq(likeRegistry.userBalances(bob), 0);
​
vm.expectRevert("No fees to withdraw");
likeRegistry.withdrawFees();
}
}
​

Recommended Mitigation

+ require(msg.value == 1 ether, "Must send exactly 1 ETH");
+ userBalances[msg.sender] += msg.value;

If overpayment is intended, explicitly account for msg.value; otherwise require exact payment.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-01] After the user calls the `likeUser` function, the userBalance does not increase by the corresponding value.

## Description User A calls `likeUser` and sends `value > 1` ETH. According to the design of DatingDapp, the amount for user A should be accumulated by `userBalances`. Otherwise, in the subsequent calculations, the balance for each user will be 0. ## Vulnerability Details When User A calls `likeUser`, the accumulation of `userBalances` is not performed. ```solidity function likeUser( address liked ) external payable { require(msg.value >= 1 ether, "Must send at least 1 ETH"); require(!likes[msg.sender][liked], "Already liked"); require(msg.sender != liked, "Cannot like yourself"); require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT"); require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT"); likes[msg.sender][liked] = true; emit Liked(msg.sender, liked); // Check if mutual like if (likes[liked][msg.sender]) { matches[msg.sender].push(liked); matches[liked].push(msg.sender); emit Matched(msg.sender, liked); matchRewards(liked, msg.sender); } } ``` This will result in `totalRewards` always being 0, affecting all subsequent calculations: ```solidity uint256 totalRewards = matchUserOne + matchUserTwo; uint256 matchingFees = (totalRewards * FIXEDFEE ) / 100; uint256 rewards = totalRewards - matchingFees; totalFees += matchingFees; ``` ## POC ```solidity function testUserBalanceshouldIncreaseAfterLike() public { vm.prank(user1); likeRegistry.likeUser{value: 20 ether}(user2); assertEq(likeRegistry.userBalances(user1), 20 ether, "User1 balance should be 20 ether"); } ``` Then we will get an error: ```shell [FAIL: User1 balance should be 20 ether: 0 != 20000000000000000000] ``` ## Impact - Users will be unable to receive rewards. - The contract owner will also be unable to withdraw ETH from the contract. ## Recommendations Add processing for `userBalances` in the `likeUser` function: ```diff function likeUser( address liked ) external payable { require(msg.value >= 1 ether, "Must send at least 1 ETH"); require(!likes[msg.sender][liked], "Already liked"); require(msg.sender != liked, "Cannot like yourself"); require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT"); require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT"); likes[msg.sender][liked] = true; + userBalances[msg.sender] += msg.value; emit Liked(msg.sender, liked); [...] } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!