Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

[H-1] `updateReferrerInfo` is incorrectly saving Referrer Information, Allowing Self-Referral Exploits

rio1101

File: SystemConfig.sol

Descritption:

The updateReferrerInfo function is intended to store the referral information, ensuring that the referrer earns a commission when their referred peers complete a transaction. However, the function currently saves referralInfo.referrer as the referrer's own address. This allows a user to mistakenly or maliciously receive rewards on their own transactions, which contradicts the intended behavior described in the protocol's documentation. The correct behavior should be to store the address of the person who referred the user, ensuring that the referrer earns rewards only from their referred peers' transactions.

function updateReferrerInfo(
//...
) external {
//...
//@audit The address used in the mapping should be the peer's address so that the referrer can earn rewards from their transactions
ReferralInfo storage referralInfo = referralInfoMap[_referrer];
referralInfo.referrer = _referrer;
//....
}

Tools Used:

Mannually review

POC:

A user can exploit this flaw by setting themselves as the referrer in updateReferrerInfo. As a result, they will earn a referral bonus on their own transactions, rather than the bonus going to the actual person who referred them.
Here’s a sample test code to demonstrate this exploit:

function test_referralSystem() public {
vm.prank(user1);
systemConfig.updateReferrerInfo(user, 300_000, 0);
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
preMarktes.createTaker(GenerateAddress.generateOfferAddress(0), 500);
vm.stopPrank();
console2.log("user", tokenManager.userTokenBalanceMap(user, address(mockUSDCToken), TokenBalanceType.ReferralBonus));
}

This test can be placed in the PreMarkets.t.sol file to verify the issue.

Recommendation:

Modify the updateReferrerInfo function to take peerAddress as an argument map it to the referrer in the referralInfoMap mapping. This will make sure that the referrer earns rewards on every transaction made by their referred peers.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.