M-1: No unlike / refund path — one-sided likes are hostage to the liked user's decision

Summary

The only state transition that moves a liker's payment is matchRewards, which requires a mutual like. There is no unlike(), no timeout, and no way for a liker to reclaim funds if the liked user never reciprocates. Even with proper balance crediting, one-sided balances could only ever be drained by a mutual match. An attacker can farm likes with a free fake profile and simply never reciprocates.

PoC (Foundry, PASS)

test_M1_oneSidedLikeUnrecoverable: Alice likes Bob (1 ETH); Bob never reciprocates. Asserts: 1 ETH sits in the registry, likes[alice][bob] is true with no undo function, both withdrawFees paths revert. PASS.

Recommended mitigation

Add unlike(address) refunding the liker's accumulated unmatched balance, or a time-boxed escrow (like expires after N days, then refundable). At minimum a withdrawUnmatched() pull function.