Submission Details
Severity:
Incorrect access control on `updateReferrerInfo` allowing anyone can update the referrer information with arbitrary values except for the referrer.
## Summary
Incorrect Access control in the `updateReferrerInfo` allowing anyone to update the referrer information with arbitrary values instead of the actual referrer.
## Vulnerability Details
`updateReferrerInfo` updates the `referrerRate` and `authorityRate` values for a `referrer`.
```
function updateReferrerInfo(
address _referrer,
uint256 _referrerRate,
uint256 _authorityRate
) external {
```
There is a check that the `msg.sender` is not the referrer.
```
if (_msgSender() == _referrer) {
revert InvalidReferrer(_referrer);
}
```
Depending on how this was designed to be implemented, this seems to be incorrect as it should allow only the referrer to update the `referralInfo` according to how the `_referrerRate`and `_authorityRate` must be split.
Additionally the documentation around the referral program seems to be ambiguous.
## Impact
This allows for anyone to set arbitrary values for the `_referrerRate` and `_authorityRate` causing loss of rewards for the referrals and causing inconsistent distribution.
## Tools Used
## Recommendations
Allow only permissioned actors to call `updateReferrerInfo`. Assuming this would be a valid referrer in this case change the code to:
```
if (_msgSender() != _referrer) {
revert InvalidReferrer(_referrer);
}
```
Updates
Lead Judging Commences
0xnevi about 1 year ago
Submission Judgement Published Assigned finding tags:
finding-SystemConfig-updateReferrerInfo-msgSender
Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts
Prize pool breakdown
Total prize
27,750 USDC
nSLOC
1,22923 USDC / LOC
25,000 USDC
2,750 USDC
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.