Description:

According to the natspec of updateReferrerInfo() the function is not supposed to be called by the referrer, so that
people don't go on setting referral for themselves.

Code snippet:
https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/SystemConfig.sol#L38-L52

However, anyone user can simply use another wallet address to bypass this system and set referral for themselves.

Impact:

This will cause severely impact the protocol as none of the users will be able earn any authorityRate

Given that authorityRate can be highly incentivised by the referrer so that more and more users use their referral link, this will break the system.

Proof of Concept:

Suppose user1 wants to call updateReferrerInfo with referrer as user1 and then the corresponding authorityRate and referrerRate, as per the code snippet this will be prevented.

However, user1 can simply use another wallet, lets call it cibilWallet and use that wallet to call the function.
In this case the _msgSender() will be cibilWallet where as the referrer will be user1 and this will pass.

This breaks the intended functionality of the protocol.

Recommended Mitigation:

One solution could be that instead of users setting the referral information, the referrers should set this information and then add the referred people to a mapping referrerToReferred, this mapping can then be used to validate such referral data.