[H-3] Missing Access Control in `updateReferrerInfo` allowing referrer overwriting
File: SystemConfig.sol
Descritption:
The updateReferrerInfo function lacks access control, allowing any user to call the function and overwrite existing referrer information. This means a user could potentially overwriting someone else's referrer information. This could lead to incorrect referral bonuses being allocated, and a malicious user could claim bonuses that were meant for the actual referrer.
Tools Used:
Mannually review
Recommendation:
Implement access control in the updateReferrerInfo function to ensure that only the protocol's admin/owner can update the referral information once the peers have signed up and completed a trade on Tadle. This will prevent unauthorized users from overwriting referrer information and claiming referral bonuses that were meant for others.
Lead Judging Commences
finding-SystemConfig-updateReferrerInfo-msgSender
Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.