DatingDapp
AI First Flight #6
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

FIXEDFEE is hardcoded as immutable with no setter, preventing the owner from adjusting the fee rate after deployment

virgilbb

Root + Impact

Description

  • LikeRegistry collects a 10% fee from every match reward via matchRewards(). The fee rate is stored as uint256 immutable FIXEDFEE = 10, making it permanently fixed at 10% for the entire lifetime of the contract.

  • The owner has no function to change the fee rate. If the protocol needs to adjust fees for competitive or regulatory reasons, the only option is to deploy an entirely new LikeRegistry contract, losing all existing state (likes, matches, balances).

// src/LikeRegistry.sol
uint256 immutable FIXEDFEE = 10; // @> hardcoded 10%, cannot be changed by owner
​
function matchRewards(address from, address to) internal {
...
uint256 matchingFees = (totalRewards * FIXEDFEE) / 100;
...
}

Risk

Likelihood:

  • The protocol will eventually need to adjust fees. With an immutable fee constant, every adjustment requires a full redeployment and state migration.

Impact:

  • Owner cannot respond to market conditions, competitive pressure, or governance decisions without a breaking redeployment. Users on the old contract retain their history (likes, matches) but would need to migrate to interact with a new fee structure.

Proof of Concept

A grep of the source confirms FIXEDFEE is declared immutable and no setter function exists in the contract. The immutable keyword bakes the value into bytecode at construction — no transaction can change it after deployment.

grep -n "FIXEDFEE\|immutable" src/LikeRegistry.sol
17: uint256 immutable FIXEDFEE = 10;

No setFee, updateFee, or similar function exists in the contract. The immutable keyword ensures the value is baked into the bytecode at construction and cannot be altered by any transaction.

Recommended Mitigation

Replace the immutable constant with a state variable and add an owner-restricted setter:

- uint256 immutable FIXEDFEE = 10;
+ uint256 public feePercent = 10;
+ uint256 public constant MAX_FEE = 20; // cap to protect users
​
+ function setFeePercent(uint256 _feePercent) external onlyOwner {
+ require(_feePercent <= MAX_FEE, "Fee too high");
+ feePercent = _feePercent;
+ }
​
function matchRewards(address from, address to) internal {
...
- uint256 matchingFees = (totalRewards * FIXEDFEE) / 100;
+ uint256 matchingFees = (totalRewards * feePercent) / 100;
...
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 4 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!