Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Giving referral bonus without being enforced to interact with the protocol

fyamf

Summary

Anybody can update the referral info on a referrer, so that the referrer gets a referral bonus. The issue is that the address who is updating the referral info on a referrer is not enforced to trade or work with the platform.

Vulnerability Details

For example, Bob would like to place an order (taker). Bob with address_A calls the function updateReferrerInfo with the following parameters:

  • _referrer: address_B

  • _referrerRate: 300_000 (equivalent to 30% as REFERRAL_RATE_DECIMAL_SCALER = 1_000_000)

  • _authorityRate: 0

Then, Bob places on order with address_B by calling the function createTaker. Since, address_B got referred by address_A, it will get some referral bonus. So, Bob could get referral bonus by just a fake reference created by himself.

ReferralInfo memory referralInfo = systemConfig.getReferralInfo(
_msgSender()
);

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L199

uint256 referrerReferralBonus = platformFee.mulDiv(
referralInfo.referrerRate,
Constants.REFERRAL_RATE_DECIMAL_SCALER,
Math.Rounding.Floor
);
​
/**
* @dev update referrer referral bonus
* @dev update authority referral bonus
*/
tokenManager.addTokenBalance(
TokenBalanceType.ReferralBonus,
referralInfo.referrer,
makerInfo.tokenAddress,
referrerReferralBonus
);

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L858-L873

Impact

  • Giving reference to itself with another address to get referral bonus on platform fee.

Tools Used

Recommendations

The function updateReferrerInfo should be called when a user is placing an order. In that case we are sure that the user is working with platform and his referral is valid.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.