Zaros Part 1

Summary

The handling of referral codes in the system does not adequately validate or sanitize input. This can lead to malformed referral codes when isCustomReferralCode is set to true. Such vulnerabilities can result in URI-breaking characters being processed, potentially leading to issues like cross-site scripting attacks and data integrity problems.

Vulnerability Details

The vulnerability originates from the system’s inadequate validation of referral codes given as input to https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/TradingAccountBranch.sol#L229-L280, especially when isCustomReferralCode is true. Referral codes containing non-printable or URI-unsafe characters can disrupt the system in multiple ways. Specifically:

1. Malformed Referral Codes: Referral codes with non-printable or control characters (e.g., null bytes or escape sequences) can cause the smart contract to process invalid data, leading to unexpected behavior.

2. Cross-Site Scripting (XSS): In contexts where referral codes are rendered in web interfaces or external systems, non-printable or special characters could lead to cross-site scripting vulnerabilities.

3. System Instability: Improperly validated referral codes might cause errors or inconsistencies in user data, potentially leading to data integrity issues.

Let's explore such a secnario:

1. The attacker crafts a referral code containing a sequence of characters designed to exploit a vulnerability in the smart contract's data handling logic. This code might include characters such as null bytes (\x00), escape sequences, or other control characters.
   string memory maliciousReferralCode = string(abi.encodePacked("malicious", bytes1(0x00), "code"));

2. The attacker creates a trading account using the crafted referral code.

   calling createTradingAccount(bytes(maliciousReferralCode), true); which will create a custom referral code

3. The attacker then uses this referral code to create a trading account.

   perpsEngine.createTradingAccount(bytes(maliciousReferralCode), true);

Here is POC test of unsafe custom referral codes any of the unsafeRefferalCodes passed as attribute don't revert:

Impact

Malformed referral codes can lead to data integrity issues, incorrect associations, or unexpected behavior in system operations, potentially causing system inconsistencies and exposing security vulnerabilities.

Tools Used

Manual Review, Foundy

Recommendations

To mitigate this vulnerability, strict validation should be enforced on referral codes. The validation process should ensure that:

• Referral codes consist only of printable, URI-safe characters.

• Referral codes do not contain any control characters or special characters that could break URIs or cause security issues.

Here is an example of such validation: