Zaros Part 1

Summary

The createTradingAccount function in AccountManager.sol allows users to pass any address as a referral code without verifying if the address corresponds to an existing trading account within the system. This can lead to the misuse of referral codes and potential system abuse.

Vulnerability Details

The function createTradingAccount accepts a referral code and a boolean isCustomReferralCode to determine how to validate the referral code. If isCustomReferralCode is false, the function decodes the referral code as an address but does not check if this address corresponds to a valid trading account within the protocol. This allows users to encode any address into bytes and use it as a referral code.

Detailed Explanation

When isCustomReferralCode is false, the function decodes referralCode into an address without any validation to check if the address corresponds to a valid trading account. This can allow users to provide any address as a referral, potentially leading to abuse of the referral system.

Impact

• Misuse of Referral Codes: Users can encode any address into bytes and use it as a referral code without validation, potentially leading to misuse and abuse of the referral system.

• Potential Fraud: Malicious users could create multiple accounts using arbitrary addresses as referral codes to gain unfair advantages or rewards.

Tools Used

Manual review

Recommendations

1. Verify Referral Address: Add a check to ensure that the decoded address corresponds to an existing trading account within the protocol before accepting it as a valid referral code.