Tadle

Summary

When updateReferrerInfo is called the function wrongly updates the given referrer's referralInfo instead of the msg.sender's referralInfo.

ReferralInfo storage referralInfo = referralInfoMap[_referrer];

Vulnerability Details

Example-

• alice wants to change the referral rates and the authority rates

• alice's referrer is bob,

• alice calls updateReferrerInfo with bob, new rate, new rate,

• but alice's referralInfoMap stays the same and the referralInfoMap of bob is changed instead.

Because of this mistake, the function is also open to anyone to call it to change someonelse's referral rates.
Example-

• attacker calls updateReferrerInfo with referrer as Alice to change Alice's referrerRate s.

Impact

Breaks the whole purpose of the referral system,

• a user can never set his own referral rate,

• anyone can change the referral rates of someonelse.

Note: The intention or the design of the referral system is not clear, and I'm writing this report assuming the referralInfo is to be set by the user himself. But even the intention was to be set by someone else for the user, eitherway the system is still broken because anyone can change it or the user can change it himself. Also the mapping update is done for the given referrer and mapping itself has the given referrer as its own referrer, it makes no sense, both the rates will go to the given referrer.

Tools Used

manual

Recommendations

In updateReferrerInfo function replace the line :