Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

custom referral code check is bypassable

avci

Summary

custom referral code check is bypassable

Vulnerability Details

in TradingAccountBranch.sol and createTradingAccount() function's isCustomReferralCode bool check is useless and is bypassable because user can just set the boolean of is custom Referral code to false.

Impact

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/TradingAccountBranch.sol#L257

the check if (isCustomReferralCode) will be bypassed

function createTradingAccount(
bytes memory referralCode,
bool isCustomReferralCode
)
public
virtual
returns (uint128 tradingAccountId)
{
// fetch storage slot for global config
GlobalConfiguration.Data storage globalConfiguration = GlobalConfiguration.load();
​
// increment next account id & output
tradingAccountId = ++globalConfiguration.nextAccountId;
​
// get refrence to account nft token
IAccountNFT tradingAccountToken = IAccountNFT(globalConfiguration.tradingAccountToken);
​
// create account record
TradingAccount.create(tradingAccountId, msg.sender);
​
// mint nft token to account owner
tradingAccountToken.mint(msg.sender, tradingAccountId);
​
emit LogCreateTradingAccount(tradingAccountId, msg.sender);
​
Referral.Data storage referral = Referral.load(msg.sender);
​
if (referralCode.length != 0 && referral.referralCode.length == 0) {
if (isCustomReferralCode) {
CustomReferralConfiguration.Data storage customReferral =
CustomReferralConfiguration.load(string(referralCode));
if (customReferral.referrer == address(0)) {
revert Errors.InvalidReferralCode();
}
referral.referralCode = referralCode;
referral.isCustomReferralCode = true;
} else {
address referrer = abi.decode(referralCode, (address));
​
if (referrer == msg.sender) {
revert Errors.InvalidReferralCode();
}
​
referral.referralCode = referralCode;
referral.isCustomReferralCode = false;
}
​
emit LogReferralSet(msg.sender, referral.getReferrerAddress(), referralCode, isCustomReferralCode);
}
​
return tradingAccountId;
}
​

Tools Used

vs code

Recommendations

  • consider modifying conrtact to the way user cannot set boolean manually

Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Too generic

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.