Summary

As per the tadle documentation and UI , we can clearly see that even in case of no extra referral rate we can toggle the amount of commission we want to set for us vs the person we want to refer.

However the way updateReferrerInfo is implemented this is not possible.

Vulnerability Details

In the code snippet below, we can see that when the referralExtraRate is zero, the only possible value of referrerRate is baseReferralRate

Impact

Referrers can not incentivize people to use their code if they do not have an extra referral rate. This is against the documentation and breaks the functionality of the protocol

Tools Used

Manual Review

Recommendations

Let the referrer call the function and allow them to set the rates