Summary

The createCustomReferralCode function in the GlobalConfigurationBranch contract lacks an existence check when creating new custom referral codes. While the risk of unauthorized overwrites is mitigated by access control, the absence of an on-chain existence check could lead to accidental overwrites, potentially impacting the integrity of the referral system in the Zaros protocol.

Vulnerability Detail

The vulnerability exists in the createCustomReferralCode function.

While the function is protected by the onlyOwner modifier, it lacks checks for:

1. Existence of the referral code

2. Validity of the referral code (length, character set)

3. Non-zero referrer address

Impact

Accidental overwrites, depending on the owner's management processes.

Despite the low probability, the potential impact could be significant:

1. Accidental overwriting of existing referral relationships

2. Potential for referral code "theft"

3. Reduced integrity and reliability of the referral system

4. Possible economic implications due to incorrect reward distributions

In the context of Zaros, a financial protocol dealing with perpetual futures trading, even low-probability risks warrant mitigation due to the potential financial implications.

Tool used

Manual Review

Recommendation

Despite the low probability, implementing an existence check is still highly recommended because:

1. It provides an additional layer of security against both malicious and accidental overwrites.

2. It enforces good practices and reduces reliance on off-chain processes to track and manage referral codes.

3. The cost of implementing this check is minimal compared to the potential impact of an overwrite.

4. It aligns with the principle of defense in depth in security design.

To address this vulnerability, implement comprehensive checks in the createCustomReferralCode function. Here's an improved version of the function incorporating best practices:

This implementation addresses the following:

1. Checks for zero address referrer

2. Enforces a minimum length for referral codes

3. Prevents duplicate referral codes using a mapping

4. Ensures referral codes only contain alphanumeric characters