DatingDapp
AI First Flight #6
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Submission Details
Severity: high
Valid

LikeRegistry::likeUser never credits msg.value to userBalances, so matches fund the MultiSig with 0 ETH and all like payments are permanently locked

prasadreddy

Root + Impact

Description

  • Normal behavior: each like costs at least 1 ETH. On a mutual like, both users' accumulated payments (minus a 10% fee) are moved to a shared MultiSig wallet for their date.

  • Issue: `likeUser()` accepts the ETH but never records it in `userBalances`. `matchRewards()` reads `userBalances`, so it always sees 0, deploys a MultiSig with 0 ETH, and collects 0 fees. The ETH stays in `LikeRegistry`, which has no function that can send it out.

// Root cause in the codebase with @> marks to highlight the relevant section
​
```solidity
function likeUser(address liked) external payable {
require(msg.value >= 1 ether, "Must send at least 1 ETH");
...
likes[msg.sender][liked] = true;
// @> msg.value is never added to userBalances[msg.sender]
emit Liked(msg.sender, liked);
​
if (likes[liked][msg.sender]) {
...
matchRewards(liked, msg.sender);
}
}
​
function matchRewards(address from, address to) internal {
// @> always 0, because nothing ever increases userBalances
uint256 matchUserOne = userBalances[from];
uint256 matchUserTwo = userBalances[to];
...
}
```

Risk

Likelihood:

  • Happens on every `likeUser()` call, since the credit is missing unconditionally.

Impact:

  • Every ETH sent to like a profile is permanently locked in `LikeRegistry`.

  • Matched users get a MultiSig with 0 ETH, and `withdrawFees()` always reverts because `totalFees` stays 0, so the core feature of the protocol does not work.

Proof of Concept

Alice and Bob each like the other with 1 ETH, which creates a match. The registry holds 2 ETH, both `userBalances` entries are 0, and the owner has no fees to withdraw.

Save as `test/PoC.t.sol` and run `forge test --mt test_likePaymentsAreNeverCredited -vv`.
​
```solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
​
import {Test, console} from "forge-std/Test.sol";
import {LikeRegistry} from "../src/LikeRegistry.sol";
import {SoulboundProfileNFT} from "../src/SoulboundProfileNFT.sol";
​
contract PoC is Test {
SoulboundProfileNFT nft;
LikeRegistry registry;
address alice = makeAddr("alice");
address bob = makeAddr("bob");
​
function setUp() public {
nft = new SoulboundProfileNFT();
registry = new LikeRegistry(address(nft));
vm.deal(alice, 10 ether);
vm.deal(bob, 10 ether);
vm.prank(alice);
nft.mintProfile("Alice", 25, "ipfs://alice");
vm.prank(bob);
nft.mintProfile("Bob", 25, "ipfs://bob");
}
​
function test_likePaymentsAreNeverCredited() public {
// 1. Alice likes Bob with 1 ETH
vm.prank(alice);
registry.likeUser{value: 1 ether}(bob);
​
// 2. Bob likes Alice back with 1 ETH, creating a match and triggering matchRewards
vm.prank(bob);
registry.likeUser{value: 1 ether}(alice);
​
// 3. 2 ETH sit in the registry, but nobody is credited
console.log("registry balance:", address(registry).balance); // 2 ether
console.log("alice credited :", registry.userBalances(alice)); // 0
assertEq(address(registry).balance, 2 ether);
assertEq(registry.userBalances(alice), 0);
assertEq(registry.userBalances(bob), 0);
​
// 4. No fees were collected, so even the owner cannot move the ETH
vm.expectRevert("No fees to withdraw");
registry.withdrawFees();
}
}
```
​

Recommended Mitigation

`matchRewards()` pays out from `userBalances`, so `likeUser()` must credit the sender's payment there. With this one line, a match pools both users' real payments, takes the 10% fee, and funds the MultiSig.
​
```diff
likes[msg.sender][liked] = true;
+ userBalances[msg.sender] += msg.value;
emit Liked(msg.sender, liked);
```
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-01] After the user calls the `likeUser` function, the userBalance does not increase by the corresponding value.

## Description User A calls `likeUser` and sends `value > 1` ETH. According to the design of DatingDapp, the amount for user A should be accumulated by `userBalances`. Otherwise, in the subsequent calculations, the balance for each user will be 0. ## Vulnerability Details When User A calls `likeUser`, the accumulation of `userBalances` is not performed. ```solidity function likeUser( address liked ) external payable { require(msg.value >= 1 ether, "Must send at least 1 ETH"); require(!likes[msg.sender][liked], "Already liked"); require(msg.sender != liked, "Cannot like yourself"); require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT"); require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT"); likes[msg.sender][liked] = true; emit Liked(msg.sender, liked); // Check if mutual like if (likes[liked][msg.sender]) { matches[msg.sender].push(liked); matches[liked].push(msg.sender); emit Matched(msg.sender, liked); matchRewards(liked, msg.sender); } } ``` This will result in `totalRewards` always being 0, affecting all subsequent calculations: ```solidity uint256 totalRewards = matchUserOne + matchUserTwo; uint256 matchingFees = (totalRewards * FIXEDFEE ) / 100; uint256 rewards = totalRewards - matchingFees; totalFees += matchingFees; ``` ## POC ```solidity function testUserBalanceshouldIncreaseAfterLike() public { vm.prank(user1); likeRegistry.likeUser{value: 20 ether}(user2); assertEq(likeRegistry.userBalances(user1), 20 ether, "User1 balance should be 20 ether"); } ``` Then we will get an error: ```shell [FAIL: User1 balance should be 20 ether: 0 != 20000000000000000000] ``` ## Impact - Users will be unable to receive rewards. - The contract owner will also be unable to withdraw ETH from the contract. ## Recommendations Add processing for `userBalances` in the `likeUser` function: ```diff function likeUser( address liked ) external payable { require(msg.value >= 1 ether, "Must send at least 1 ETH"); require(!likes[msg.sender][liked], "Already liked"); require(msg.sender != liked, "Cannot like yourself"); require(profileNFT.profileToToken(msg.sender) != 0, "Must have a profile NFT"); require(profileNFT.profileToToken(liked) != 0, "Liked user must have a profile NFT"); likes[msg.sender][liked] = true; + userBalances[msg.sender] += msg.value; emit Liked(msg.sender, liked); [...] } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!