[H-01] SystemConfig::updateReferrerInfo Updates _referrer Info Instead of Caller's

Summary

The updateReferrerInfo function is utilized by users to set or update their referrals. However, a critical bug causes the _referrer's referralInfo mapping to be updated instead of the caller's (msg.sender). Consequently, the referral system fails entirely, with everyone's referrer being set to themselves.

Vulnerability Details

Upon execution, the function mistakenly loads the referralInfoMap of the _referrer instead of msg.sender. Subsequently, the values are set accordingly, leading to incorrect updates in the referral system.

Impact

This bug renders the referral system ineffective, preventing users from correctly setting their referrers. Additionally, it allows anyone to change another user's referrer to themselves by simply invoking this function once.

Proof of Concept

The following test demonstrates the failure of the referral system due to this bug. It attempts to update a user's referral to user1 but fails to change the referrer. Moreover, it incorrectly sets user1's referral to themselves.

Tools Used

Manual Review

Recommendations

To correct this issue, the function should load the referralInfoMap using msg.sender instead of _referrer. The corrected version of the function is as follows:

This correction ensures that the referral information is correctly updated for the caller (msg.sender), restoring the functionality of the referral system as intended.