Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Referrer overriding in `createCustomReferralCode` leads to misallocated rewards

Panthers

Github
https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/GlobalConfigurationBranch.sol#L632-L636

Summary

The createCustomReferralCode function allows referrer overriding.

Impact

The new user will receive rewards for the previous user's activities if the referrer is overwritten.

Proof of Concept

Assume User A refers User B using a custom referral code "REF123". User A expects to receive rewards for User B's activity. However, if admin overwrites the referrer for "REF123" to User C, User C will start receiving rewards instead of User A.

Recommendation

Add a check to prevent overriding an existing referrer:

function createCustomReferralCode(address referrer, string memory customReferralCode) external onlyOwner {
CustomReferralConfiguration.Data storage config = CustomReferralConfiguration.load(customReferralCode);
require(config.referrer == address(0), "Referral code already has a referrer");
​
config.referrer = referrer;
emit LogCreateCustomReferralCode(referrer, customReferralCode);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

0xtheblackpanther Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
0xtheblackpanther Submitter
about 1 year ago
inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Referrals should be set per trading account id instead of per trader

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.