`SystemConfig::updateReferrerInfo` anyone can update referrer info
Summary
Anyone can call SystemConfig::updateReferrerInfo. The access should be more strict, cause anyone can change referrer info.
Vulnerability Details
Inside SystemConfig::updateReferrerInfo there is no owner modifier or check, except:
But msg.sender is not used further in the function, only the _referrer parameter is used for storage changes. It means the user can easily skip the above check by calling this function from another wallet, but with the same arguments he/she wanted in the first place.
Impact
Anyone can change referrer info
Tools Used
Manual review
Recommendations
Add more strict validation to the function about msg.sender
Lead Judging Commences
finding-SystemConfig-updateReferrerInfo-msgSender
Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.