Tadle

Description:

The Referral system on tadle works in the following way:

• user1 creates a referral code

• assuming that user1 had brought in a lot of users to the platform, he had a referralExtraRate set to 10%

• Now the user adjusts the referral distribution in the following way: 30% for referrerRate and 10% authorityRate and shares it with user2

Here authorityRate means that whenever user2 trades, they are supposed to get back 10% of the platform fee.

However, anyone malicious user3 can call the updateReferrerInfo for user2 and set the authority rate to 0.

Relevant code snippet:
https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/SystemConfig.sol#L41-L80

Impact:

This will cause severely impact the protocol as none of the users will be able earn any authorityRate

Given that authorityRate can be highly incentivised by the referrer so that more and more users use their referral link, this will break the system.

Proof of Concept:

In PreMarkets.sol, whenever a createTaker() is called that is when someone tries to match the offer created by createoffer() it internally calls _updateReferralBonus to add the referralBonus balance to the trader, they will expect to be able to withdraw it by calling TokenManager::withdraw() however they wont have any balance left:

Recommended Mitigation:

Ideally when the referrer decides the split, only they should be able to update their referral system, and a mapping of referrerToReferred should be added so that whenever someone related to the referrer trades, they are mapped to the referrer's mapping.