Tadle

Summary

The updateReferrerInfo() function allowing any user to call it and set the referral relationship to referer => referralInfo, resulting in the referrer of an account is the account itself. This vulnerability enables anyone to change another user's referrer, leading to a corrupted referral system.

Vulnerability Details

The updateReferrerInfo() function allows updating a user's referral information. The referral data is stored in the referralInfoMap(user => referralInfo) mapping, which tracks referral information for each user.

The function incorrectly uses _referrer as the key in the referralInfoMap mapping (L69), which should instead represent the user account whose referral information is being updated. This results in the mapping storing referrer => referralInfo, meaning that the referrer is mapped to itself:

Impact

Allowing unauthorized users to alter referral relationships, leading to a corrupted referral system.

Tools Used

vscode

Recommendations