Zaros Part 1

Vulnerability Details

In the TradingAccountBranch.sol contract, the createTradingAccount() function implements a referral system that allows users to provide a referral code when creating a new trading account. The function handles two types of referral codes: custom and non-custom.

For non-custom referral codes, the function correctly prevents self-referral by checking if the referrer's address matches the msg.sender:

TradingAccountBranch.sol#L260-L262

However, for custom referral codes, this check is not implemented:

This implementation allows a user to create a custom referral code that refers to themselves, potentially exploiting the referral system for unintended benefits.

Impact

Users could create custom referral codes referring to themselves, potentially earning referral rewards without actually referring new users.

Proof of Concept

1. Owner creates a custom referral code that maps to Alice's address with createCustomReferralCode:

2. Alice calls createTradingAccount() with her custom referral code and isCustomReferralCode set to true.

3. The function processes the custom referral code without checking for self-referral.

4. Alice's account is created with her own referral code, allowing her to receive referral benefits for her own account creation.

Recommendations

To mitigate this vulnerability, implement a self-referral check for custom referral codes similar to the one used for non-custom codes: