Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

_authorityRate can't be set, breaking intended functionality of referral system

wellbyt3

Summary

In SystemConfig.sol, when updateReferrerInfo() is called with an _authorityRate greater than 0, the function always will revert with either of the two errors found in ISystemConfig.sol, breaking the protocols intended functionality.

  1. error InvalidReferrerRate(uint256 referrerRate);

  2. error InvalidRate(uint256 referrerRate, uint256 authorityRate, uint256 totalRate);

Vulnerability Details

When a referrer refers a referree, the referrer is supposed to receive a percentage of the platform fee according to the _referrerRate and the referree is also supposed to receive a portion of the platform fee according to the _authorityRate.

Here's the problematic code (link):

function updateReferrerInfo(
address _referrer,
uint256 _referrerRate,
uint256 _authorityRate
) external {
...
if (_referrerRate < baseReferralRate) {
revert InvalidReferrerRate(_referrerRate);
}
​
uint256 referralExtraRate = referralExtraRateMap[_referrer];
​
uint256 totalRate = baseReferralRate + referralExtraRate;
​
if (totalRate > Constants.REFERRAL_RATE_DECIMAL_SCALER) {
revert InvalidTotalRate(totalRate);
}
​
if (_referrerRate + _authorityRate != totalRate) {
revert InvalidRate(_referrerRate, _authorityRate, totalRate);
}
​
...
}
​

The baseReferralRate is set by the protocol team. For sake of example, let's say it's 300000 (i.e. 30%).

Certain referrers can get a bump in this rate (referralExtraRate) also set by the protocol team, but let's assume it's 0 for this example.

totalRate is 300000 or 30%.

So according to this code block, the _referrerRate + _authorityRate must equal 300000 or the function reverts:

if (_referrerRate + _authorityRate != totalRate) {
revert InvalidRate(_referrerRate, _authorityRate, totalRate);
}

But in the following code block, the _referrerRate must be greater than or equal to 300000, otherwise the function reverts:

if (_referrerRate < baseReferralRate) {
revert InvalidReferrerRate(_referrerRate);
}

These two code block make it impossible for _authorityRate to be set to anything but 0.

Here's a POC fuzz testing (add to PreMarket.t.sol):

function testAuthorityRatesCantBeSet(uint256 referralRate, uint256 authorityRate) public {
// 1. Assumptions
vm.assume(
referralRate >= 0 && referralRate <= baseReferralRate
&& authorityRate > 0 && authorityRate <= baseReferralRate
);
​
// 2. Set referrer and referee addresses
address referree = vm.addr(0x1234);
address referrer = vm.addr(0x5678);
vm.startPrank(referree);
// 3. Expect revert because assumption prevent authorityRate from being set to 0
vm.expectRevert();
systemConfig.updateReferrerInfo(referrer, referralRate, authorityRate);
vm.stopPrank();
}

Impact

Protocol doesn't function as expected and referrers can't incentivize referrees with an authority rate.

Tools Used

Manual Review / Foundry

Recommendations

Replace this:

if (_referrerRate < baseReferralRate) {
revert InvalidReferrerRate(_referrerRate);
}

With this:

if (_referrerRate > baseReferralRate) {
revert InvalidReferrerRate(_referrerRate);
}

And consider replacing this:

if (_referrerRate + _authorityRate != totalRate) {
revert InvalidRate(_referrerRate, _authorityRate, totalRate);
}

With this:

if (_referrerRate + _authorityRate > totalRate) {
revert InvalidRate(_referrerRate, _authorityRate, totalRate);
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-wrong-referral-rate-combined-check

Valid medium, specific valid inputs by admin will still cause revert in updates to referral info due to incorrect totalRate computation and checks implemented. Note: Downgrade to low severity: This is a valid issue that highlights a valid inconsistency in the docs. In the docs, it was mentioned in the steps that referral rates can be adjusted up to a maximum of 30% as seen in [Step 4. ](https://tadle.gitbook.io/tadle/tadle-incentives-program/referral-program/create-and-manage-referral)but as of now, the minimum refferal rate is 30%. However, since refferals are entirely optional, if a minimum 30% refferal rate is established and the user deems it as too high, he can simply choose not to perform the refferal. Hence, I believe low severity to be appropriate.

Appeal created

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-wrong-referral-rate-combined-check

Valid medium, specific valid inputs by admin will still cause revert in updates to referral info due to incorrect totalRate computation and checks implemented. Note: Downgrade to low severity: This is a valid issue that highlights a valid inconsistency in the docs. In the docs, it was mentioned in the steps that referral rates can be adjusted up to a maximum of 30% as seen in [Step 4. ](https://tadle.gitbook.io/tadle/tadle-incentives-program/referral-program/create-and-manage-referral)but as of now, the minimum refferal rate is 30%. However, since refferals are entirely optional, if a minimum 30% refferal rate is established and the user deems it as too high, he can simply choose not to perform the refferal. Hence, I believe low severity to be appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.