Tadle

Summary

The updateReferrerInfo function in the SystemConfig contract unintentionally allows the creation of new referrals in addition to updating existing ones. This can lead to unexpected behaviors and data integrity issues.

Vulnerability Details

The updateReferrerInfo function doesn't verify if the referral already exists before updating the information. If called with a non-existent referral address, it creates a new entry in the map.

Impact

1. Security: Malicious users could create unauthorized referral relationships.

2. Data Integrity: May create unintended or invalid referral records.

3. Business Logic: May interfere with the intended referral system logic, potentially affecting reward distribution.

Tools Used

Manual code analysis.

Recommendations

1. Modify the updateReferrerInfo function to prevent creation of new referrals:

   • Add a check to ensure the referral exists before updating.

   • If the referral doesn't exist, the function should revert.

2. Create a separate function for adding new referrals, if needed.

3. Implement proper access controls for both update and creation functions.

4. Update code documentation to clearly reflect the purpose and behavior of each function.