Tadle

Summary

The SystemConfig.updateReferrerInfo function permits any user to set up referral rates for any referrer address without sufficient restrictions. This opens up the system to exploitation, where a user can create an alt account, assign it an inflated referral rate, and use it to unjustly claim higher referral bonuses.

Vulnerability Details

• The updateReferrerInfo function in the SystemConfig contract allows any user to specify a referral rate for any address.

• There are no ownership checks to confirm that the caller owns the referrer address being updated, allowing any user to create and update referral rates for any address.

• A malicious user can create an alt account, assign it as a referrer, and set an inflated referral rate, leading to the alt account earning a significant amount of referral bonuses during subsequent trades.

• This vulnerability break this invariant that _msgSender() != _referrer in a referral system in a indirect way, where the referrer should be different from the caller to prevent self-referral abuse.

Code Snippet

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/SystemConfig.sol#L41-L80

Impact

This vulnerability allows users to:

• Create alt accounts and set high referral rates, enabling them to earn excessive referral bonuses.

• Thus same user can uses multiple accounts to earn more referral bonus for themselves while trading as maker/taker.

Proof Of Concept

Setup:

• Alice has two accounts: Main Account (Alice_Main) and Alt Account (Alice_Alt).

• Alice uses Alice_Main to call the updateReferrerInfo function, assigning Alice_Alt as a referrer with an abnormally high referral rate.

Exploitation:

• Alice performs trades using Alice_Main that trigger referral bonuses.

• Alice_Alt receives referral bonuses based on the inflated rate set by Alice_Main.

Outcome:

• Alice effectively uses her alt account to collect excessive referral bonuses.

• This exploitation can be repeated, multiple trades to get more referral bonus for the same user.

Tools Used

• Manual Review

• Foundry

Recommendations

• Introduce a validation mechanism in the updateReferrerInfo function to ensure that referral rate updates can only be made by the owner of the referrer address.

• Implement a whitelisting mechanism to restrict the addresses that can be set as referrers, preventing the creation of alt accounts for referral bonus manipulation.