Tadle

Summary

In the SystemConfig::updateReferrerInfo function, the referralInfoMap is mistakenly updated for the _referrer instead of the _msgSender(). This allows anyone to modify the referralInfo for other users, which results in several issues:

1. Anyone can modify another user’s referralInfoMap.

2. When a user tries to update his own referralInfo, the update is ineffective.

3. If a _referrer later uses PreMarkets::createTaker, the referrerReferralBonus could be wrongly attributed to himself, leading to incorrect self-referral bonuses.

Vulnerability Details

In the SystemConfig::updateReferrerInfo function, the following code incorrectly updates the referralInfoMap:

This causes the referralInfoMap to be incorrectly updated for _referrer, not _msgSender(). This becomes problematic when referralInfoMap is later queried in PreMarkets::createTaker:

The assignment and usage of referralInfoMap is actually inconsistent:
- User A could set referralInfoMap info for User B, and he can't set it for himself.
- When User A calls createTaker, referralInfoMap[A] is queried instead of referralInfoMap[B].

This inconsistency causes several problems:

1. Anyone can modify the referralInfoMap for any other user.

2. Updates by users to their own referral information are ineffective.

3. If _referrer uses PreMarkets::createTaker, the referral bonus could wrongly go to himself, creating an invalid self-referral scenario.

Impact

This issue could have a Medium to High impact:

1. Anyone can modify the referralInfoMap for any other user.

2. Updates by users to their own referral information are ineffective.

3. If _referrer uses PreMarkets::createTaker, the referral bonus could wrongly go to himself, creating an invalid self-referral scenario.

Tools Used

Manual, VSCode

Recommendations

To resolve this issue, modify the updateReferrerInfo function so that it updates referralInfoMap for _msgSender() instead of _referrer. This will ensure that users can only update their own referral info and prevent the issues described above. Otherwise, refactor how the ReferralInfo is being used.