No Validation of params in `initialize` Function
Github
https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/SystemConfig.sol#L25
Summary
The initialize function in the SystemConfig contract allows setting of base platform fee rate and base referral rate. If both values are set to zero, it causes logical issues in the updateReferrerInfo function.
Vulnerability Details
The initialize function can set both _basePlatformFeeRate and _baseReferralRate to zero. This introduces a flaw in the updateReferrerInfo function where it relies on these rates for validation. The initialize function does not prevent zero values for base rates, which can lead to unintended behavior in subsequent function calls and overall code wherever these variables are used.
If baseReferralRate is zero, the comparison if (_referrerRate < baseReferralRate) in updateReferrerInfo function becomes ineffective and it will lead to DOS as continous reverts will be faced because of it. Additionally, the calculation of totalRate might lead to unexpected reverts or incorrect validations when baseReferralRate is zero.
Impact
With baseReferralRate set to zero, the updateReferrerInfo function will face permanent DOS due to regular reverts.
Tools Used
Manual Review
Recommendations
Modify the initialize function to ensure that both _basePlatformFeeRate and _baseReferralRate are non-zero.
Lead Judging Commences
[invalid] finding-Admin-Errors-Malicious
The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.