Part 2

Summary

Referral view functions read data from wrong storage location rendering those function useless.

Vulnerability Details

When an user register a referral code, referralConfiguration is loaded from storage based on calling engine address.

The problem is that verifyIfUserHasReferral and getUserReferralData aren't called from market-making-engine.
This means these function will read form a different storage slot and will return invalid data.

Impact

Functions return invalid referral data making it harder for protocol and its users to interogate onchain data.

Tools Used

Recommendations

There are 2 sollutions:

• call these function from market-making-engine so the msg.sender will be the engine and correct storage slots will be interrogated;

• pass the engine address as a parameter to these functions and load the configuration similarly to how it's done for [getReferrerAddress()