issues : 21
Great issue: Prevent Self-Referral Reward Exploits
Description
The referrer parameter in the place_bet function is accepted without any identity verification. This allows a malicious bettor to provide their own secondary address (or even the same address) as a referrer for every bet, effectively gaining a systematic discount on all protocol fees and draining the referral pool intended for actual promoters.
Requirements and context
- Add a strict requirement check:
require!(referrer != bettor).
- Consider implementing a "Referrer Whitelist" or verification system for high-volume accounts.
Suggested execution
- Fork the repo and create a branch:
git checkout -b fix/issue-21-self-referral
- Update the betting authorization logic.
Implementation changes
- Modify
bets.rs (around line 19) to validate the bettor and referrer are distinct entities.
Test and commit
- Verify that a bet attempt where
referrer == bettor results in an immediate transaction failure.
Example commit message
fix: prevent bettors from referring themselves to claim fee discounts
Guidelines
- Economic integrity of the referral system.
- Timeframe: 24 hours.
issues : 21
Great issue: Prevent Self-Referral Reward Exploits
Description
The
referrerparameter in theplace_betfunction is accepted without any identity verification. This allows a malicious bettor to provide their own secondary address (or even the same address) as a referrer for every bet, effectively gaining a systematic discount on all protocol fees and draining the referral pool intended for actual promoters.Requirements and context
require!(referrer != bettor).Suggested execution
git checkout -b fix/issue-21-self-referralImplementation changes
bets.rs(around line 19) to validate the bettor and referrer are distinct entities.Test and commit
referrer == bettorresults in an immediate transaction failure.Example commit message
fix: prevent bettors from referring themselves to claim fee discounts
Guidelines