Zaros Part 1

Vulnerability Details

Currently referrals are tracked by emitting an event when a user calls createTradingAccount

This is not the right step to track because there is no cost associated with calling createTradingAccount, therefore whatever benefits users get for referrals can be inflated easily by using multiple accounts and calling createTradingAccount with a specific referral code.

The referral system should be implemented at a step where margin is deposited or a trade is created. These have a cost associated and are therefore likely to be legitimate referrals

Impact

Honest users of the referral system will get less rewards because the attackers get more

Attackers can spam the referral system for no cost

Significant number of illegitimate referrals

Tools Used

Manual review

Recommendations

Implement the referral system when a user creates an order, not creating an account