Incorrect `referralInfoMap` mapping entry updated when calling `SystemConfig.updateReferrerInfo()` function.
Summary
The contract state is incorrectly updated after calling the SystemConfig.updateReferrerInfo() function.
Vulnerability Details
In the following code:
The referralInfo points to referralInfoMap[_referrer] when it should point to referralInfoMap[_msgSender()].
This leads to the following issues:
There is no access control when calling the
SystemConfig.updateReferrerInfo()function.Users can only refer to themselves, contradicting the
@notice _referrer != _msgSender()statement.
Impact
Invalid access control.
Incorrect contract state update.
Broken referral system.
Tools Used
Manual review.
Recommendations
Use the proper user from the referralInfoMap mapping by accessing it with the _msgSender() address:
Lead Judging Commences
finding-SystemConfig-updateReferrerInfo-msgSender
Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.