Tadle

Summary

The SystemConfig::updateReferrerInfo function lacks proper asignation, enabling users to either set themselves as their own referrer or update other users' referrer information without authorization.

Vulnerability Details

The SystemConfig::updateReferrerInfo function is meant to update a user's referral information. However, the current implementation allows users to set themselves as their own referrer or modify the referral information of other users, which should not be permitted.

This implementation allows users to update the referral information tied to the _referrer address, rather than the address of the user making the request (msg.sender). As a result, a user can set themselves as their own referrer or change the referral details of other users.

Although there is a check to prevent a user from setting themselves as their referrer:

This check is ineffective because users can still modify the referral information of other users, including setting their own address as the referrer.

Impact

Users can bypass restrictions and set themselves as their own referrer and can unauthorizedly update the referrer information of other users

Tools Used

• Manual Code Review

Recommendations

Update the updateReferrerInfo function: