Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can adjust others referral bonus rates once an extra rate is set.

mattjenkins

Summary

When an extra rate is added to a referrer, then the function SystemConfig.updateReferrerInfo can be called by anyone (other than the referrer) to adjust the _referrerRate and the _authorityRate within those bounds.

Vulnerability Details

The SystemConfig.updateReferrerInfo function has no checks on who is calling apart from making sure the caller isn't the referrer themselves.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/SystemConfig.sol#L41

Impact

The bonus that a referrer gets when an action happens they have referred depends on the values of _referrerRate. If the referrer has been awarded an extra rate, then this can be taken off the referrer when the bonus is caluclated and sent somewhere else based on the authorityReferrer instead.

This can be seen by adding this setup to the test_ask_turbo_chain function in the test script PreMarkets.t.sol.

function test_ask_turbo_chain() public {
​
vm.startPrank(user1);
systemConfig.updateReferralExtraRateMap(user2, Constants.REFERRAL_RATE_DECIMAL_SCALER-baseReferralRate);
vm.stopPrank();
​
vm.startPrank(user);
systemConfig.updateReferrerInfo(user2, baseReferralRate+100, Constants.REFERRAL_RATE_DECIMAL_SCALER-baseReferralRate-100);
vm.stopPrank();
​

Tools Used

Manual review + foundry

Recommendations

Lock down the function so that it is not publiclly executable.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.