Tadle

Summary

The updateReferrerInfo function in the SystemConfig.sol contract lacks proper access control, allowing any user to call the function and update the referrer information, only The Refferer its self can't call it. This can lead to unauthorized manipulation of referral rates, which could result in financial losses or unfair distribution of rewards

Vulnerability Details

The updateReferrerInfo function is currently marked as external, allowing any account to call it. The only restriction is that the caller cannot be the same as the referrer being updated. This design allows for potential abuse:

1. An attacker could update referrer information for any address without proper authorization.

2. Legitimate referrers could have their rates modified without their consent.

3. The contract owner has no control over who can modify referral settings.

A malicious actor could exploit this by:

1. Creating multiple accounts

2. Using one account to set favorable referral rates for another

3. Potentially manipulating the referral system

Impact

This vulnerability could lead to unauthorized users manipulating referral rates, resulting in financial losses for the protocol. Malicious actors could decrease their referral rates without proper authorization, skewing the distribution of rewards and undermining the integrity of the referral system.

Tools Used

Manual code Review
Foundry

Recommendations

Add access control to the updateReferrerInfo function. This could be done by:

• Adding an onlyOwner modifier to restrict access to the contract owner.