Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can update the referrer's referrer and authority rates to cause the maker to always get zero bonus.

tinnohofficial

Summary

The function SystemConfig::updateReferrerInfo can be called by anyone other that the referrer. Anyone can can adjust these rates and thus cause the authority (maker) to get zero bonus always.

Vulnerability Details

SystemConfig::updateReferrerInfo has no access control as seen below

// @audit the can be called by ANYONE except the _referrer
function updateReferrerInfo(address _referrer, uint256 _referrerRate, uint256) external {
if (_msgSender() == _referrer) {
revert InvalidReferrer(_referrer);
}
​
if (_referrer == address(0x0)) {
revert Errors.ZeroAddress();
}
​
if (_referrerRate < baseReferralRate) { // @audit-info
revert InvalidReferrerRate(_referrerRate);
}
​
uint256 referralExtraRate = referralExtraRateMap[_referrer];
uint256 totalRate = baseReferralRate + referralExtraRate;
​
if (totalRate > Constants.REFERRAL_RATE_DECIMAL_SCALER) {
revert InvalidTotalRate(totalRate);
}
​
if (_referrerRate + _authorityRate != totalRate) {
revert InvalidRate(_referrerRate, _authorityRate, totalRate);
}
​
ReferralInfo storage referralInfo = referralInfoMap[_referrer];
referralInfo.referrer = _referrer;
referralInfo.referrerRate = _referrerRate;
referralInfo.authorityRate = _authorityRate;
​
emit UpdateReferrerInfo(
msg.sender,
_referrer,
_referrerRate,
_authorityRate
);
}

These rates are actually used within functions like PreMarkets::createTaker in the internal function _updateReferralBonus, therefore allowing anyone to change the rates is not reasonable.

function _updateReferralBonus( //...
//...
uint256 referrerReferralBonus = platformFee.mulDiv(
referralInfo.referrerRate, // @audit used in the referrerReferralBonus calculation
Constants.REFERRAL_RATE_DECIMAL_SCALER,
Math.Rounding.Floor
);
​
/**
* @dev update referrer referral bonus
* @dev update authority referral bonus
*/
tokenManager.addTokenBalance(
TokenBalanceType.ReferralBonus,
referralInfo.referrer,
makerInfo.tokenAddress,
referrerReferralBonus // @audit this can be manipulated by anyone
);
​
uint256 authorityReferralBonus = platformFee.mulDiv(
referralInfo.authorityRate, // @audit used in the authorityReferralBonus calculation
Constants.REFERRAL_RATE_DECIMAL_SCALER,
Math.Rounding.Floor
);
​
tokenManager.addTokenBalance(
TokenBalanceType.ReferralBonus,
_msgSender(),
makerInfo.tokenAddress,
authorityReferralBonus // @audit this can be manipulated by anyone
);
​
// ...
}

PoC

Add this line import "../src/interfaces/ISystemConfig.sol"; at top of PreMarketsTest and then the function below

function test_update_referrer_info() public {
address referrer = makeAddr("referrer");
address attacker = makeAddr("attacker");
​
vm.prank(user1); // user1 is the owner (guardian)
systemConfig.updateReferralExtraRateMap(referrer, 700_000);
​
vm.prank(attacker);
// @audit attacker can manipulate these rates to any numbers
systemConfig.updateReferrerInfo(referrer, 1000_000, 0);
​
ReferralInfo memory referralInfo = systemConfig.getReferralInfo(referrer);
​
assertEq(referralInfo.referrerRate, 1000_000);
assertEq(referralInfo.authorityRate, 0);
}

Impact

Anyone can grief the authority from getting bonus and giving the referrer the excess extra referral rate.

Tools Used

Manual review

Recommendations

Add access control to the function to restrict anyone from calling it. Consider allowing only the owner onlyOwner modifier

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.