DatingDapp
AI First Flight #6
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

userBalances never incremented — matched users receive 0 ETH rewards

r0p

Title: userBalances never incremented — matched users receive 0 ETH rewards
Severity: High
Impact: All ETH sent via likeUser is trapped; matched couples get empty multisig wallets.
Likelihood: High — deterministic, affects every like and every match.
Reference Files: src/LikeRegistry.sol:31-48, src/LikeRegistry.sol:50-67

Description

likeUser receives ETH via msg.value but never adds it to userBalances. When users match, matchRewards reads both balances — always 0 — and deploys an empty multisig. The vulnerable code:

function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
likes[msg.sender][liked] = true;
if (likes[liked][msg.sender]) {
matchRewards(liked, msg.sender);
}
}
​
function matchRewards(address from, address to) internal {
uint256 matchUserOne = userBalances[from]; // always 0
uint256 matchUserTwo = userBalances[to]; // always 0
uint256 totalRewards = matchUserOne + matchUserTwo; // 0
MultiSigWallet w = new MultiSigWallet(from, to);
payable(address(w)).call{value: 0}(""); // sends nothing
}

No line in LikeRegistry sets userBalances[msg.sender] += msg.value. Every matched couple receives a deployed-but-empty multisig wallet.

Risk

Impact: High. Users pay 1 ETH per like expecting pooled rewards on match, but receive 0 ETH. All ETH accumulates in LikeRegistry with no recovery. The dapp's core value is broken.
Likelihood: High. Deterministic — every like, every match, always zero rewards.
Alice and Bob each like each other (2 ETH total). They match expecting ~1.8 ETH. They get 0 ETH and 2 ETH is permanently trapped.

Proof of Concept

function testMatchedUsersGetZeroRewards() public {
vm.deal(alice, 2 ether); vm.deal(bob, 2 ether);
vm.prank(alice); nft.mintProfile("Alice", 25, "ipfs://alice");
vm.prank(bob); nft.mintProfile("Bob", 28, "ipfs://bob");
vm.prank(alice); registry.likeUser{value: 1 ether}(bob);
assertEq(registry.userBalances(alice), 0); // never updated!
vm.prank(bob); registry.likeUser{value: 1 ether}(alice);
assertEq(address(registry).balance, 2 ether); // trapped
}

2 ETH permanently locked, matched users get 0 ETH.

Recommended Mitigation

userBalances[msg.sender] += msg.value;

Add this line inside likeUser before the mutual-like check to credit each user's contribution, enabling matchRewards to calculate correct pooled rewards.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 1 day ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-01] After the user calls the `likeUser` function, the userBalance does not increase by the corresponding value.

## Description User A calls `likeUser` and sends `value > 1` ETH. According to the design of DatingDapp, the amount for user A should be accumulated by `userBalances`. Otherwise, in the subsequent calculations, the balance for each user will be 0. ## Vulnerability Details When User A calls `likeUser`, the accumulation of `userBalances` is not performed. ```solidity function likeUser( address liked ) external payable { require(msg.value >= 1 ether, "Must send at least 1 ETH"); require(!likes[msg.sender][liked], "Already liked"); require(msg.sender != liked, "Cannot like yourself"); require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT"); require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT"); likes[msg.sender][liked] = true; emit Liked(msg.sender, liked); // Check if mutual like if (likes[liked][msg.sender]) { matches[msg.sender].push(liked); matches[liked].push(msg.sender); emit Matched(msg.sender, liked); matchRewards(liked, msg.sender); } } ``` This will result in `totalRewards` always being 0, affecting all subsequent calculations: ```solidity uint256 totalRewards = matchUserOne + matchUserTwo; uint256 matchingFees = (totalRewards * FIXEDFEE ) / 100; uint256 rewards = totalRewards - matchingFees; totalFees += matchingFees; ``` ## POC ```solidity function testUserBalanceshouldIncreaseAfterLike() public { vm.prank(user1); likeRegistry.likeUser{value: 20 ether}(user2); assertEq(likeRegistry.userBalances(user1), 20 ether, "User1 balance should be 20 ether"); } ``` Then we will get an error: ```shell [FAIL: User1 balance should be 20 ether: 0 != 20000000000000000000] ``` ## Impact - Users will be unable to receive rewards. - The contract owner will also be unable to withdraw ETH from the contract. ## Recommendations Add processing for `userBalances` in the `likeUser` function: ```diff function likeUser( address liked ) external payable { require(msg.value >= 1 ether, "Must send at least 1 ETH"); require(!likes[msg.sender][liked], "Already liked"); require(msg.sender != liked, "Cannot like yourself"); require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT"); require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT"); likes[msg.sender][liked] = true; + userBalances[msg.sender] += msg.value; emit Liked(msg.sender, liked); [...] } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!