Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Referral bonus will be wrongly distributed due to the referral info is not properly set

h2134

Summary

No referral bonus will be distributed even if referral info is set, due to the key of referralInfoMap mapping is wrongly used.

Vulnerability Details

When a user creates taker, referral bonus is expected to be distributed to referrer if the user's referral info is set.

tokenManager.addTokenBalance(
TokenBalanceType.ReferralBonus,
referralInfo.referrer,
makerInfo.tokenAddress,
referrerReferralBonus
);
​
...
​
tokenManager.addTokenBalance(
TokenBalanceType.ReferralBonus,
_msgSender(),
makerInfo.tokenAddress,
authorityReferralBonus
);

User can call updateReferrerInfo() to set the referral info, and the info will be recorded in referralInfoMap.

ReferralInfo storage referralInfo = referralInfoMap[_referrer];
referralInfo.referrer = _referrer;
referralInfo.referrerRate = _referrerRate;
referralInfo.authorityRate = _authorityRate;

However, the key of the referralInfoMap mapping is wrongly used, it should be msg.sender instead of _referrer. As a result, referral bonus will be wrongly distributed. Image the following scenario:

  1. Alice calls updateReferrerInfo and set Bob as her referrer, referralInfoMap is updated as referralInfoMap[Bob] = Bob;

  2. Bob calls updateReferrerInfo and set Cathy as her referrer, referralInfoMap is updated as referralInfoMap[Cath] = Cathy;

  3. When Bob creates taker, the referral bonus is expected to be distributed to Cathy, but because referralInfoMap[Bob] = Bob, the bonus is wrongly distributed to Bob;

  4. Likewise, when Cathy creates taker, no referral bonus is expected but Cathy will receive bonus due to the referral info set by Bob.

Impact

Referral bonus is wrongly distributed.

Tools Used

Manual Review

Recommendations

The key of referralInfoMap mapping should be the caller instead of the _referrer.

- ReferralInfo storage referralInfo = referralInfoMap[_referrer];
+ ReferralInfo storage referralInfo = referralInfoMap[msg.sender];
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!