Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Referrer Assignment in updateReferrerInfo Function

Tomas0707

Summary

The updateReferrerInfo function in the SystemConfig.sol contract incorrectly assigns the referrer of a user to the user themselves. This error prevents the proper distribution of referral fees, as the system fails to correctly identify the true referrer.

Vulnerability Details

The updateReferrerInfo function is intended to set the referrer information for users in the Tadle protocol. However, the line referralInfo.referrer = _referrer; within the function assigns the user's own address as their referrer. This assignment is incorrect and disrupts the referral bonus mechanism, as it prevents the correct identification of the referrer who should receive the referral bonus.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/SystemConfig.sol#L69-L72

Impact

This vulnerability has a high impact because it undermines the entire referral system of the protocol. Users who refer others to the platform will not receive the referral bonuses they are entitled to, potentially leading to loss of trust in the platform and a significant decrease in user engagement and growth.

Proof of Concept

This is the test code of the vulnerability.

function test_ask_turbo_chain() public {
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
​
address offerAddr = GenerateAddress.generateOfferAddress(0);
vm.stopPrank();
​
vm.prank(user1);
systemConfig.updateReferrerInfo(address(user2), 300000, 0);
vm.startPrank(user2);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
preMarktes.createTaker(offerAddr, 700);
​
ReferralInfo memory referralInfo = systemConfig.getReferralInfo(address(user2));
console2.log("user1 address:", address(user1));
console2.log("user2 address:", address(user2));
testLibrary.logReferralInfo(referralInfo);
}

The result is like this.

user1 address: 0x2B5AD5c4795c026514f8317c7a215E218DcCD6cF
user2 address: 0x6813Eb9362372EEF6200f3b1dbC3f819671cBA69
Referrer: 0x6813Eb9362372EEF6200f3b1dbC3f819671cBA69
Referrer Rate: 300000
Authority Rate: 0
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
│ │ │ │ │ └─ ← [Return] UpgradeableProxy: [0x3C8Ca53ee5661D29d3d3C0732689a4b86947EAF0]
│ │ │ │ ├─ emit AddTokenBalance(accountAddress: 0x6813Eb9362372EEF6200f3b1dbC3f819671cBA69, tokenAddress: MockERC20Token: [0xF62849F9A0B5Bf2913b396098F7c7019b51A820a], tokenBalanceType: 1, amount: 0)
│ │ │ │ └─ ← [Stop]
│ │ │ └─ ← [Return]
│ │ ├─ emit ReferralBonus(stock: 0x7AFBC26d177182f1C9b99c324a78c99aF4545ba8, authority: 0x6813Eb9362372EEF6200f3b1dbC3f819671cBA69, referrer: 0x6813Eb9362372EEF6200f3b1dbC3f819671cBA69, authorityReferralBonus: 0, referrerReferralBonus: 10500000000000 [1.05e13], tradingVolume: 7000000000000000 [7e15], tradingFee: 35000000000000 [3.5e13])

As you can see, referrer of user2 is set to itself, not to real referrer (user1). And the ReferralBonus is added to user2, not to user1.

Tools Used

Manual code review

Recommendations

To correct this issue, the function should be redesigned like this.

ReferralInfo storage referralInfo = referralInfoMap[_referrer];
referralInfo.referrer = _msgSender();
referralInfo.referrerRate = _referrerRate;
referralInfo.authorityRate = _authorityRate;
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.