DatingDapp

Pending Like ETH Becomes Permanently Locked When a Liked Profile Is Burned or Blocked

Description

Users can pay 1 ETH to like another valid profile. When the like is not yet mutual, the ETH remains pending in LikeRegistry until the other user reciprocates and the protocol creates a match.
The issue is that SoulboundProfileNFT allows a profile to be burned by the user or blocked by the owner without notifying LikeRegistry. Once the liked profile is removed, the pending like can no longer be completed because LikeRegistry.likeUser() requires both users to have active profile NFTs. The original 1 ETH remains stuck in LikeRegistry, is not refunded, and is not withdrawable as fees.
// LikeRegistry.sol
function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");

}

// SoulboundProfileNFT.sol
function burnProfile() external {
uint256 tokenId = profileToToken[msg.sender];
require(tokenId != 0, "No profile found");

}

function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");

}
Risk
Likelihood: Medium
This occurs whenever a user pays to like a profile and that liked profile is burned or blocked before reciprocating.

Profile deletion and owner blocking are normal protocol lifecycle actions, so this does not require privileged misuse beyond the intended blockProfile() flow or a user choosing to burn their own profile.

Impact: Medium
The liker’s pending 1 ETH becomes permanently locked in LikeRegistry.

The ETH is not sent to a match multisig, not refunded to the liker, and not withdrawable through withdrawFees() because totalFees was never increased.

Proof of Concept
The following test shows Alice paying 1 ETH to like Bob. Bob then burns his profile before reciprocating. Because Bob no longer has a profile NFT, he cannot complete the mutual match, and Alice’s ETH remains stuck in LikeRegistry.
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;

import "forge-std/Test.sol";
import "../src/SoulboundProfileNFT.sol";
import "../src/LikeRegistry.sol";

contract BurnBlockLocksPendingLikeTest is Test {
SoulboundProfileNFT nft;
LikeRegistry registry;

}
Recommended Mitigation
Before a profile is burned or blocked, clear all pending likes involving that profile and refund the affected users. One approach is to make SoulboundProfileNFT notify LikeRegistry before deleting a profile.

diff --git a/contracts/SoulboundProfileNFT.sol b/contracts/SoulboundProfileNFT.sol
index abc1234..def5678 100644
--- a/contracts/SoulboundProfileNFT.sol
+++ b/contracts/SoulboundProfileNFT.sol
@@
+interface ILikeRegistry {

• function cancelPendingLikes(address user) external;
  +}

• 
  

contract SoulboundProfileNFT is ERC721, Ownable {

• ILikeRegistry public likeRegistry;

• 
  

• function setLikeRegistry(address registry) external onlyOwner {

• 
  
  likeRegistry = ILikeRegistry(registry);

• }

• 
  

@@
function burnProfile() external {
uint256 tokenId = profileToToken[msg.sender];
require(tokenId != 0, "No profile found");

• likeRegistry.cancelPendingLikes(msg.sender);

• _burn(tokenId);
  delete profileToToken[msg.sender];
  delete _profiles[tokenId];
  }
  @@
  function blockProfile(address blockAddress) external onlyOwner {
  uint256 tokenId = profileToToken[blockAddress];
  require(tokenId != 0, "No profile found");

• likeRegistry.cancelPendingLikes(blockAddress);

• _burn(tokenId);
  delete profileToToken[blockAddress];
  delete _profiles[tokenId];
  }
  LikeRegistry.cancelPendingLikes() should refund pending like ETH for all unresolved likes involving the profile being removed, then clear the corresponding pending like state.