Zaros Part 1

Summary

Incorrect function modifier used leading to incorrect return data

Vulnerability Details

This function is marked as pure, but it's actually reading from storage. Here are the issues:

1. pure Function Modifier: The pure modifier is used for functions that don't read from or modify the contract's state. However, this function is clearly reading from storage by calling Referral.load(user).

2. Inconsistency with Storage Access: The Referral.load(user) function is accessing storage to retrieve the referral data for the given user. This operation cannot be performed in a pure function.

3. Potential for Misleading Behavior: Because the function is marked as pure, it will compile and deploy without errors, but it won't actually return the correct data. Instead, it will likely return default values (empty bytes for referralCode and false for isCustomReferralCode) regardless of the actual stored data.

Impact

The function is marked as pure, it will compile and deploy without errors, but it won't actually return the correct data. Instead, it will likely return default values (empty bytes for referralCode and false for isCustomReferralCode) regardless of the actual stored data.

Tools Used

Manual Review

Recommendations

Change the function modifier from pure to view