Tadle

Summary

A flaw in the access control implementation allows referrers to manipulate their referral information and claim all the rewards intended for both the authority and the referrer.

Vulnerability Details

In the SystemConfig::updateReferrerInfo function, users are permitted to adjust the _referrerRate and _authorityRate values for themselves and their referrer.

Key Code Section:

1. The function includes a check to prevent the _referrer from adjusting these properties:

1. The check is designed to prevent the referrer from directly adjusting their referrerRate and authorityRate values to capture all the fees meant for both themselves and the authority.

The Issue:

While the current check prevents referrers from directly making these changes, it is ineffective because the referrer can simply create a separate address to bypass this restriction. By using a new address, the referrer can set their desired _referrerRate and _authorityRate, effectively claiming all the fees that should have been shared.

Exploit Scenario:

1. A referrer creates a secondary address.

2. The referrer uses this address to update their referralInfo, setting a high _referrerRate and a low _authorityRate.

3. As a result, the referrer can claim all the rewards meant for both the authority and the referrer, leaving the authority with nothing.

Impact

This vulnerability leads to a loss of funds for the authority, as the referrer can effectively grief the authority by claiming all the rewards meant for both parties.

Tools Used

Manual

Recommendations

1. Restrict Access: Only allow the owner and the authority to update the referralRate related to their accounts.

2. Enhance Validation: Implement additional checks to ensure that referrers cannot indirectly manipulate their referral information through other accounts.