Tadle

Summary

In the SystemConfig::updateReferralExtraRateMap function, the owner can update the referralExtraRateMap for a specific referrer. However, this change does not impact the referralInfoMap entries that were set before the update unless the updateReferrerInfo function is called again. This can lead to inconsistencies and potential fund loss for the referrer due to outdated referral rates.

Vulnerability Details

The function updateReferrerInfo enforces the restriction that _referrerRate + _authorityRate must equal baseReferralRate + referralExtraRate:

However, the referralExtraRateMap can only be updated by the owner through updateReferralExtraRateMap:

The issue arises because any updates to referralExtraRateMap do not automatically affect previously set referralInfoMap. For these changes to take effect, the updateReferrerInfo function must be called for each referral again, which could lead to:

1. Inconsistency: The referralInfoMap may contain outdated information that does not reflect the latest referralExtraRateMap values.

2. Potential Fund Loss: If the outdated referralInfoMap is used in subsequent transactions, it could result in incorrect referral bonuses, leading to financial loss for the referrer.

Impact

The update to referralExtraRateMap does not affect previously set referralInfoMap unless the updateReferrerInfo function is called again. This can cause inconsistencies and potential financial losses for the referrer due to outdated referral rates being used.

Tools Used

Manual

Recommendations

The _authorityRate could be deduced from baseReferralRate + referralExtraRate[_referral] - referrerRate instead of storing it directly(of course, some additional cases should be taken into account). This approach ensures that the referralInfoMap is always in sync with the latest referralExtraRateMap values, eliminating the need to update referralInfoMap manually after each change.