Incorrect update for referrer information in updateReferrerInfo() in SystemConfig.sol
Summary
The referrer information including referrer, referrerRate and _authorityRate are incorrectly updated to the wrong role(_referrer), not the msg.sender.
Vulnerability Details
In function updateReferrerInfo() in SystemConfig.sol, the passed parameter _referrer, _referrerRate, _authorityRate are supposed to stored as values of referralInfoMap of msg.sender. Instead, they are updated as refferalInfoMap[_referrer].
Impact
referralInfo is called when createTaker() in PreMarkets.sol, and a part of platformFee is distributed to both the referrer and the authority, each proportional to referralRate and authorityRate. If the referralInfo loaded is updated incorrectly, this will cause the fee loss of the authority and the referrer.
Tools Used
manual
Recommendations
Rectify the address key of mapping variables referralExtralRateMap and referralInfoMap in function updateReferrerInfo() in SystemConfig.sol
Lead Judging Commences
finding-SystemConfig-updateReferrerInfo-msgSender
Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.