Part 2

Summary

Custom Referral codes can be overwritten, Allowing unauthorized takeover

Vulnerability Details

The function createCustomReferralCode allows setting a new referral code without checking if the code is already assigned. This means a malicious actor (or even a registered engine) can overwrite an existing referral code and assign themselves as the new referrer. effectively stealing referral rewards from the original owner.

Impact

• Referral code hijacking:
  A malicious entity could overwrite a popular referral code (e.g., "VIP123") and redirect rewards to themselves.

• Loss of earnings:
  Original referrers lose their rightful commissions.

• Unfair Exploitation:
  Bad actors can systematically take over high value referral codes:

Tools Used

Manual Review

Recommendations

• Implement existence check before setting a referral code.

• Consider adding an "owner-only" update mechanism, so only original referrer can modify their referral code.