Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Malicious users can set themselves referrer to claim referrer rewards as well

100HP

Summary

Vulnerability Details

The platformFee rewarded as bonus to the referral and the one who is referring others. On creating a taker position via createTaker(), a percentage of platformFee as a bonus is get divided into msg.sender and referralInfo.referrer.

function _updateReferralBonus(
uint256 platformFee,
uint256 depositAmount,
address stockAddr,
MakerInfo storage makerInfo,
ReferralInfo memory referralInfo,
ITokenManager tokenManager
) internal returns (uint256 remainingPlatformFee) {
...snip...
uint256 referrerReferralBonus = platformFee.mulDiv( // @audit get referrer bonus
referralInfo.referrerRate,
Constants.REFERRAL_RATE_DECIMAL_SCALER,
Math.Rounding.Floor
);
​
/**
* @dev update referrer referral bonus
* @dev update authority referral bonus
*/
tokenManager.addTokenBalance(
TokenBalanceType.ReferralBonus,
referralInfo.referrer,
makerInfo.tokenAddress,
referrerReferralBonus
);
​
uint256 authorityReferralBonus = platformFee.mulDiv( // @audit get referral bonus
referralInfo.authorityRate,
Constants.REFERRAL_RATE_DECIMAL_SCALER,
Math.Rounding.Floor
);
​
tokenManager.addTokenBalance(
TokenBalanceType.ReferralBonus,
_msgSender(),
makerInfo.tokenAddress,
authorityReferralBonus
);
​
remainingPlatformFee =
platformFee -
referrerReferralBonus -
authorityReferralBonus;
}

The referrer setting can be changed via

function updateReferrerInfo(
address _referrer, // refer personX
uint256 _referrerRate,
uint256 _authorityRate
) external {...}

It has internal check that reverts, on referring to itself. However, the problem is this check can be bypassed.

The expected state changes are

  1. if caller==msg.sender, updateReferrerInfo(msg.sender,,) => revert

  2. if caller==msg.sender, updateReferrerInfo(elonmusk,,) => successful

But in (2), the referral itself is the referrer, e.g., referralInfoMap[elonmusk].referrer == elonmusk. We end up achieving the same state as in (1) without reverting.

Impact

Elon musk can set himself the referer by calling updateReferrerInfo(elonmusk,,) function from the different account, stealing the referrer rewards as well.

Tools Used

Manual review

Recommendations

- ReferralInfo storage referralInfo = referralInfoMap[_referrer];
+ ReferralInfo storage referralInfo = referralInfoMap[msg.sender];
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!