Summary

While creating a trading account through createTradingAccount,
an user can set the isCustomReferralCode to true or false.

• If isCustomReferralCode is set to false,

  the following check is made to ensure that

  the msg.sender cannot be the referrer

  address referrer = abi.decode(referralCode, (address));

  ​

  if (referrer == msg.sender) {

  revert Errors.InvalidReferralCode();

  }

• However, when isCustomReferralCode is set to true,

  there is no such checks,
  which allows the caller to feed their own address as referrer

https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/branches/TradingAccountBranch.sol#L256-L264

Impact

An user ( msg.sender ) can use their own address as the referrer.

Recommendations

Include the following check
when isCustomReferralCode is true