Part 2

Summary: Referral.sol permits unlimited reuse of referral codes, enabling reward manipulation.

Vulnerability Details:
The registerReferral function does not track whether a referral code has already been used by a specific user. Attackers can repeatedly apply the same code to earn illegitimate rewards.

Code Reference:

Attack Scenario:
An attacker creates a referral code, then repeatedly registers new accounts under the same code. Each registration grants the attacker referral rewards, draining the protocol’s reward pool.

Impact: Medium – Inflation of referral rewards and unfair allocation.

Recommendations:

1. Enforce one-time use per user for referral codes.

2. Store a mapping of used codes per user (e.g., mapping(address => bytes32) public userCodes;).