Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Any address can be used as referral when creating trading account

josh4324

Summary

When creating a trading account, any address can be used as a referral, there is no check to confirm if the address has an account in the zaros protocol

Vulnerability Details

The createTradingAccount function allows any address to be specified as a referral without validation. This issue can result in abuse of the referral system, as malicious users can specify addresses that are not genuine referrers.

function createTradingAccount(
bytes memory referralCode,
bool isCustomReferralCode
)
public
virtual
returns (uint128 tradingAccountId)
{
// fetch storage slot for global config
GlobalConfiguration.Data storage globalConfiguration = GlobalConfiguration.load();
// increment next account id & output
tradingAccountId = ++globalConfiguration.nextAccountId;
​
// get refrence to account nft token
IAccountNFT tradingAccountToken = IAccountNFT(globalConfiguration.tradingAccountToken);
​
// create account record
TradingAccount.create(tradingAccountId, msg.sender);
​
// mint nft token to account owner
tradingAccountToken.mint(msg.sender, tradingAccountId);
​
emit LogCreateTradingAccount(tradingAccountId, msg.sender);
​
Referral.Data storage referral = Referral.load(msg.sender);
​
if (referralCode.length != 0 && referral.referralCode.length == 0) {
if (isCustomReferralCode) {
CustomReferralConfiguration.Data storage customReferral =
CustomReferralConfiguration.load(string(referralCode));
if (customReferral.referrer == address(0)) {
revert Errors.InvalidReferralCode();
}
referral.referralCode = referralCode;
referral.isCustomReferralCode = true;
} else {
address referrer = abi.decode(referralCode, (address));
​
if (referrer == msg.sender) {
revert Errors.InvalidReferralCode();
}
​
@> referral.referralCode = referralCode;
referral.isCustomReferralCode = false;
}
​
emit LogReferralSet(msg.sender, referral.getReferrerAddress(), referralCode, isCustomReferralCode);
}
​
return tradingAccountId;
}

Impact

  1. Referral systems are meant to reward users of the protocol, the lack of validation will discourage actual users of the protocol.

  2. Non-users of the protocol can get multiple referrals and get more incentive than the users of the protocol

Tools Used

Manual Review

Recommendations

Referral address validation should be added to the createTradingAccount function.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.