The function `SystemConfig::updateReferrerInfo` allows any arbitrary non-relevant individual to update the rate split between an arbitrary referrer and their traders
Summary
The function SystemConfig::updateReferrerInfo only requires the msg.sender cannot be the _referrer himself, but no more constraints on the caller other than that. The current requirement is inadequate. Because any arbitrary individual can call this function to update the rate split of a random referrer and their traders. Being a non-relevant party, that arbitrary caller should not have such authority to do that. This function can be leveraged by any malicious user to cause a mess for other users/referrers.
Vulnerability Details
The vulnerability in this piece of logic is quite straight forward. Some more necessary access control or validations on the caller's role are needed. The current code block in these lines cannot stop an entirely non-relevant Individual A calling the function to update the rate split between a Referrer B and his Trader C, messing up the business between B and C.
Impact
This function can be leveraged by any malicious user to cause a mess on the stored values of other referrers and their traders, which makes it an M severity issue.
Tools Used
Manual Review.
Recommendations
Add more validations to only allow an individual to update the rate for the referrer who is an relevant entity to the caller himself; or implementing access control to make the function an Admin only function, while the admin can gather requests from the referrers/traders off chain.
Lead Judging Commences
finding-SystemConfig-updateReferrerInfo-msgSender
Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.