Summary

The SystemConfig::updateReferrerInfo function is not protected by the onlyOwner modifier, allowing users to change referral information without restrictions.
This lack of access control can lead to unauthorized modifications of referral data, resulting in the protocol not earning the appropriate fees when a Taker is created through the PreMarktes::createTaker function.

Vulnerability Details

The absence of the onlyOwner modifier in the updateReferrerInfo function permits unauthorized users to alter referral data.
This can lead to incorrect fee allocations when a Taker is created, as the referral information may have been modified inappropriately.

Impact

The lack of proper access control could result in the protocol missing out on fees that should be collected when Takers are created, leading to potential revenue loss and undermining the financial integrity of the protocol.

Tools Used

Manual Review

Recommendations

Implement Access Control: Add the onlyOwner modifier to the SystemConfig::updateReferrerInfo function to ensure that only the contract owner can modify referral information.

Code References

File Name: SystemConfig.sol
Line Numbers: Line 41