Tadle

Vulnerability Details

The Tadle system's SystemConfig contract manages referral rates, which are used when creating new takers. However, there's a critical vulnerability in the interaction between the updateReferrerInfo() function and the createTaker() function. An attacker can front-run a legitimate user's createTaker() call by calling updateReferrerInfo() to lower the referrer rate, resulting in the legitimate user receiving less funds than expected.

The updateReferrerInfo() function allows any caller to modify anyone's referral rates:

SystemConfig.sol#L41-L48

This function can be called by anyone to update the referral rate for any address, as long as the caller is not setting their own rate. The vulnerability arises because there's no protection against front-running when a legitimate user attempts to create a new taker with an expected referral rate.

Proof of Concept

1. Alice, a legitimate user, prepares a transaction to create a new taker, expecting a 50% referral rate.

2. Bob, a malicious actor, monitors the mempool and sees Alice's pending createTaker() transaction.

3. Bob quickly submits a transaction with a higher gas price: updateReferrerInfo(Alice's address, 300_000, 0).

4. Bob's transaction is processed first, setting Alice's referrer rate to 30%.

5. Alice's createTaker() transaction is processed next, but now uses the 30% rate instead of the expected 50%.

6. Alice receives significantly less referral earnings than she should have.

Impact

Legitimate referrers receive lower referral fees than expected.

Recommendations

Implement a time-lock mechanism for rate changes.