Tadle

Background

This submission assumes the referral system is functioning as intended. See my two other submission titled:

1. _authorityRate can't be set, breaking intended usage of referral system

2. updateReferrerInfo() incorrectly sets address in referralInfoMap to referrer instead of referree

Summary

In SystemConfig.sol, the function updateReferrerInfo() is set to external and updates ReferralInfo in the referralInfoMap mapping.

The only permissions in this function is that the caller can't be the _referrer:

Since anyone can call this function except the referrer, a malicious referree can call updateReferrerInfo() and set the _referralRate to 0 and the _authorityRate to the max allowed, effectively allowing the referree to steal the referral bonus associated with any of their future trades from the referrer.

Vulnerability Details

The referral system has two different referral bonuses:

1) referralRate: a % of the platform fee given to the referrer

2) authorityRate: a % of the platform fee given to the referree

For sake of example, the max of the sum of these 2 rates together can be 30%. So if referralRate is 30%, authorityRate has to be 0%. If referralRate is 20%, authorityRate can be 10%.

A malicious user (the referree) can get referred by a referrer, using their referral code or link.

The malicious user can call updateReferrerInfo() setting the _referrerRate to 0 and the _authorityRate to the max (e.g. 30%). Now any trades the referree makes, they'll receive the entire 30% referral bonus and the referrer will get nothing.

Impact

Loss of funds for the referrer and breaks the integrity of the referral system

Tools Used

Manual Review

Recommendations

The referral system needs to be completely rewrriten, but for this submission, make sure the referree can't update the either the _referralRate or the _authorityRate.