DatingDapp
AI First Flight #6
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Critical Logic Bug: Permanent Freezing of 100% User Funds Due to Missing userBalances Update in likeUser

aliamvaliama1b2

Root + Impact

Description

  • Describe the normal behavior in one or more sentences

  • Explain the specific issue or problem in one or more sentences

### Root Cause
In `LikeRegistry.sol`, the function `likeUser` is an `external payable` function that strictly requires users to send at least 1 Ether:
```solidity
require(msg.value >= 1 ether, "Must send at least 1 ETH");
```
However, the contract completely fails to record or credit this `msg.value` to the user's internal ledger tracking mapping `userBalances[msg.sender]`. There is no line of code that updates the state balance after receiving the Ether.
​
### Impact
When a mutual match occurs, the contract triggers the internal function `matchRewards`:
```solidity
uint256 matchUserOne = userBalances[from];
uint256 matchUserTwo = userBalances[to];
```
Because the `userBalances` mapping was never updated in `likeUser`, both `matchUserOne` and `matchUserTwo` will evaluate to `0`. Consequently, `totalRewards` and `rewards` will always calculate as `0`.
​
The real Ether transferred by users into the contract remains trapped inside the contract state forever with absolutely no withdrawal or recovery mechanism, leading to a permanent freeze of 100% of user funds.
​
### Vulnerable Code Section
In `LikeRegistry.sol` inside the `likeUser` function.
​
### Proof of Concept (PoC)
1. User A calls `likeUser(User B)` and sends exactly 1 ETH. Transaction passes, contract balance increases by 1 ETH, but `userBalances[User A]` remains 0.
2. User B calls `likeUser(User A)` and sends exactly 1 ETH. Transaction passes, contract balance increases to 2 ETH, but `userBalances[User B]` remains 0.
3. The contract detects a mutual match and executes `matchRewards(User A, User B)`.
4. The calculated rewards are 0, a Multisig is deployed with 0 value, and the 2 ETH remains permanently locked inside the `LikeRegistry` contract without any rescue function.
​

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Reason 2

Impact:

  • Impact 1

  • Impact 2

Proof of Concept

* Likelihood: 100% Guaranteed to occur because there is absolutely no state update logic implemented for userBalances inside the likeUser function.
* Impact: High, because it results in permanent freezing and locking of 100% of all user Ether deposits inside the contract, with zero recovery mechanism.
​
1. User A calls likeUser(User B) and attaches exactly 1 ETH. Transaction passes, contract balance = 1 ETH, but userBalances[User A] remains 0.
2. User B calls likeUser(User A) and attaches exactly 1 ETH. Transaction passes, contract balance = 2 ETH, but userBalances[User B] remains 0.
3. The contract registers a mutual match and automatically invokes the internal function matchRewards(User A, User B).
4. Inside matchRewards, totalRewards and rewards are calculated based on userBalances, which results in 0 rewards.
5. The 2 ETH remains trapped inside the contract state forever with no rescue or withdrawal function available.
​

Recommended Mitigation

// Inside the likeUser function of LikeRegistry.sol:
​
function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
require(!likes[msg.sender][liked], "Already liked");
require(msg.sender != liked, "Cannot like yourself");
require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT");
require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT");
​
+ userBalances[msg.sender] += msg.value;
​
likes[msg.sender][liked] = true;
emit Liked(msg.sender, liked);
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-01] After the user calls the `likeUser` function, the userBalance does not increase by the corresponding value.

## Description User A calls `likeUser` and sends `value > 1` ETH. According to the design of DatingDapp, the amount for user A should be accumulated by `userBalances`. Otherwise, in the subsequent calculations, the balance for each user will be 0. ## Vulnerability Details When User A calls `likeUser`, the accumulation of `userBalances` is not performed. ```solidity function likeUser( address liked ) external payable { require(msg.value >= 1 ether, "Must send at least 1 ETH"); require(!likes[msg.sender][liked], "Already liked"); require(msg.sender != liked, "Cannot like yourself"); require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT"); require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT"); likes[msg.sender][liked] = true; emit Liked(msg.sender, liked); // Check if mutual like if (likes[liked][msg.sender]) { matches[msg.sender].push(liked); matches[liked].push(msg.sender); emit Matched(msg.sender, liked); matchRewards(liked, msg.sender); } } ``` This will result in `totalRewards` always being 0, affecting all subsequent calculations: ```solidity uint256 totalRewards = matchUserOne + matchUserTwo; uint256 matchingFees = (totalRewards * FIXEDFEE ) / 100; uint256 rewards = totalRewards - matchingFees; totalFees += matchingFees; ``` ## POC ```solidity function testUserBalanceshouldIncreaseAfterLike() public { vm.prank(user1); likeRegistry.likeUser{value: 20 ether}(user2); assertEq(likeRegistry.userBalances(user1), 20 ether, "User1 balance should be 20 ether"); } ``` Then we will get an error: ```shell [FAIL: User1 balance should be 20 ether: 0 != 20000000000000000000] ``` ## Impact - Users will be unable to receive rewards. - The contract owner will also be unable to withdraw ETH from the contract. ## Recommendations Add processing for `userBalances` in the `likeUser` function: ```diff function likeUser( address liked ) external payable { require(msg.value >= 1 ether, "Must send at least 1 ETH"); require(!likes[msg.sender][liked], "Already liked"); require(msg.sender != liked, "Cannot like yourself"); require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT"); require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT"); likes[msg.sender][liked] = true; + userBalances[msg.sender] += msg.value; emit Liked(msg.sender, liked); [...] } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!