Tadle

Summary

The updateReferrerInfo function is designed to allow users to set their referral information within the system. However, a critical security flaw has been identified: any user can set or modify referral information for other users, as there is no check in place to ensure that only the rightful owner can set their own referral. This vulnerability can lead to unauthorized manipulation of referral data, resulting in potential financial losses, exploitation, and trust issues within the platform.

Vulnerability Details

The updateReferrerInfo function lacks a mechanism to verify that the user attempting to update the referral information is the actual owner of the account in question. This oversight allows any user to set or modify the referral information for any other user on the platform.

The absence of ownership checks opens the door for various forms of exploitation. Malicious users could systematically alter the referral information of multiple accounts, rerouting rewards and causing widespread disruption within the referral system.

Impact

This vulnerability can lead to unauthorized changes to referral data, where malicious actors could manipulate referral information to their advantage. For instance, an attacker could redirect referral rewards to their own account or to accounts under their control, depriving the rightful user of their rewards.

Tools Used

Manual Review

Recommendations

Add a check to verify that the caller is the account owner