Incorrect user stored against a referrer address
Summary
Referral address is stored against the referrer address instead of the referee.
Vulnerability Details
SystemConfig.updateReferrerInfo validates msg.sender != _referrer but at the time of storing the addresses in the mapping it stores the referral information against the referrer address itself.
Reference: https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/SystemConfig.sol#L69-L70
Impact
The entire referral model fails to work as expected. The referral rewards are given back to the trader instead of a referrer.
Tools Used
Manual Review
Recommendations
SystemConfig.updateReferrerInfo should use msg.sender as key for the mapping referralInfoMap.
So instead of ReferralInfo storage referralInfo = referralInfoMap[``referrer];_ using_ referrer as key. The correct implementation should be ReferralInfo storage referralInfo = referralInfoMap[msg.sender];.
Lead Judging Commences
finding-SystemConfig-updateReferrerInfo-msgSender
Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.