Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Traders can set themselves as referrers

samuraii77

Summary

Traders can set themselves as referrers

Vulnerability Details

Whenever a user creates a trading account, he can set a referrer:

if (referralCode.length != 0 && referral.referralCode.length == 0) {
if (isCustomReferralCode) {
CustomReferralConfiguration.Data storage customReferral = CustomReferralConfiguration.load(string(referralCode));
if (customReferral.referrer == address(0)) {
revert Errors.InvalidReferralCode();
}
referral.referralCode = referralCode;
referral.isCustomReferralCode = true;
} else {
address referrer = abi.decode(referralCode, (address));
​
if (referrer == msg.sender) {
revert Errors.InvalidReferralCode();
}
​
referral.referralCode = referralCode;
referral.isCustomReferralCode = false;
}
​
emit LogReferralSet(msg.sender, referral.getReferrerAddress(), referralCode, isCustomReferralCode);
}

We can see that if the msg.sender sets himself as the referrer, the code will revert. The thing is that a trader can still set himself as the referrer. Whenever a user creates his trading account, he is minted an NFT that is essentually his trading account. The user can do the following:

  1. Have 2 wallets

  2. Create a trading account with one of them and set his other account as the referrer

  3. Transfer out the NFT to his other account which then calls the function below due to the _update() override in AccountNFT.sol:

    function notifyAccountTransfer(address to, uint128 tradingAccountId) external {
    _onlyTradingAccountToken();
    ​
    TradingAccount.Data storage tradingAccount = TradingAccount.loadExisting(tradingAccountId);
    tradingAccount.owner = to;
    }

Now, he has successfully set himself as the referrer.

Impact

Traders can set themselves as referrers

Tools Used

Manual Review

Recommendations

Do not allow traders to transfer out their NFT to their referrer

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Referrals should be set per trading account id instead of per trader

Appeal created

samuraii77 Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Referrals should be set per trading account id instead of per trader

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.