Submitted by cmichel, also found by csanuragjain and gzeon
FeeCollectModule.sol#L99
In the fee collect modules like FeeCollectModule there is no prevention of someone submitting a second profile they own as the referrerProfileId in processCollect to receive back part of the fees paid.
The referral system is essentially broken as all rational agents will submit a second profile they control to get back part of the fees.
One could even create a referrer smart contract profile that anyone can submit which automatically refunds the fee received.
A similar royalties/referral fees issue was judged high-severity recently.
Theres no way to avoid this except by not allowing any profile as a referrer.
Whitelist certain important infrastructure providers, like different frontends, as referrers and only allow these to be used instead of users submitting their alt profiles.
Zer0dot (Aave Lens) commented:
donosonaumczuk (Aave Lens) commented:
Zer0dot (Aave Lens) commented:
donosonaumczuk (Aave Lens) disputed and commented:
0xleastwood (judge) decreased severity to Medium and commented:
Zer0dot (Aave Lens) commented:
0xleastwood (judge) commented:
Zer0dot (Aave Lens) acknowledged and commented:
