Submission Details
Severity:
Unauthorized referral info manipulation
## Summary
The updateReferrerInfo function in the SystemConfig contract allows any user to update referral information for any address, including setting arbitrary referrer addresses and rates. This vulnerability can be exploited to disable referral bonuses and authority fees of legitimate referrers, potentially leading to financial losses and undermining the integrity of the referral system.
## Vulnerability Details
The updateReferrerInfo function is externally accessible and updates the `referralInfoMap` for the provided `_referrer` address:
```solidity
function updateReferrerInfo(
address _referrer,
uint256 _referrerRate,
uint256 _authorityRate
) external {
...
ReferralInfo storage referralInfo = referralInfoMap[_referrer]; // @audit should be msg.sender
referralInfo.referrer = _referrer;
referralInfo.referrerRate = _referrerRate;
referralInfo.authorityRate = _authorityRate;
}
```
This allows any caller to set referrerRate and authorityRate to 0, effectively disabling referral bonuses and authority fees of legit referrers
## Impact
Impact: High - Lose of referral bonuses and authority fees of legit referrers
Likelihood: High - anyone can call the function to disable referral bonuses and authority fees of legit referrers
## Tools Used
Manual review
## Recommendations
- Ensure users can only update their own referral information:
```diff
function updateReferrerInfo(
address _referrer,
uint256 _referrerRate,
uint256 _authorityRate
) external {
...
- ReferralInfo storage referralInfo = referralInfoMap[_referrer];
+ ReferralInfo storage referralInfo = referralInfoMap[msg.sender];
referralInfo.referrer = _referrer;
referralInfo.referrerRate = _referrerRate;
referralInfo.authorityRate = _authorityRate;
}
```
- Or only allow admin to config the rates.
Updates
Lead Judging Commences
0xnevi 12 months ago
Submission Judgement Published Assigned finding tags:
finding-SystemConfig-updateReferrerInfo-msgSender
Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts
Prize pool breakdown
Total prize
27,750 USDC
nSLOC
1,22923 USDC / LOC
25,000 USDC
2,750 USDC
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.