Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Referrer info is updated incorrectly in `updateReferrerInfo`

y4y

Summary

updateReferrerInfo updates referrer info incorrectly, it allows anyone to set other people's referrer info, causing potential fund lose.

Vulnerability Details

We see referrer info can be updated:

function updateReferrerInfo(
address _referrer,
uint256 _referrerRate,
uint256 _authorityRate
) external {
if (_msgSender() == _referrer) {
revert InvalidReferrer(_referrer);
}
​
if (_referrer == address(0x0)) {
revert Errors.ZeroAddress();
}
​
if (_referrerRate < baseReferralRate) {
revert InvalidReferrerRate(_referrerRate);
}
​
uint256 referralExtraRate = referralExtraRateMap[_referrer];
uint256 totalRate = baseReferralRate + referralExtraRate;
​
if (totalRate > Constants.REFERRAL_RATE_DECIMAL_SCALER) {
revert InvalidTotalRate(totalRate);
}
​
if (_referrerRate + _authorityRate != totalRate) {
revert InvalidRate(_referrerRate, _authorityRate, totalRate);
}
​
ReferralInfo storage referralInfo = referralInfoMap[_referrer];
referralInfo.referrer = _referrer;
referralInfo.referrerRate = _referrerRate;
referralInfo.authorityRate = _authorityRate;
​
emit UpdateReferrerInfo(
msg.sender,
_referrer,
_referrerRate,
_authorityRate
);
}
​

The faulty line of code lies here:

ReferralInfo storage referralInfo = referralInfoMap[_referrer];

Which the info for _referrer is set, instead of msg.sender. This allows anyone to modify other people's referrer entry. As when trade happens, partial fees are distributed to referrers and authorities, a malicious authority can set his offer taker's referrer's authority rate to the total rate, and get extra fees out of the exchange, even if the taker doesn't anticipate.

Impact

A malicious maker can update his potential offer taker's referrer info to make fee distribution favoring to him, earning extra fees.

Tools Used

Manual review

Recommendations

Change the faulty line to:

ReferralInfo storage referralInfo = referralInfoMap[_msgSender()];
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!