[CRITICAL] `register_referral` doesn't validate that the referrer is registered — unregistered referrers get paid

[grantfox-oss]

Summary

prediction_market/src/lib.rs place_bet calls referral_registry.credit(...) with the referrer address, but never validates that the referrer is actually registered in the referral registry. Any user can pass an arbitrary address as their "referrer" and the system will pay referral fees to it.

Impact

• Free fee diversion: a user can set any address as referrer — including their own hot wallet or a contract they control — and receive referral fees with no validation.
• No registration proof: there is no check that the referrer's address has a valid ReferrerInfo record or has opted into the referral program.
• Sybil amplification: an attacker can self-refer all bets, claiming the 50 bps referral fee on every trade.

Fix

• In place_bet, before calling credit, verify the referrer address exists in ReferrerInfo storage.
• If the referrer is not registered, treat the bet as referrer-less and route the 50 bps to AccumulatedFees instead.
• Add a is_registered_referrer(address) view function to the referral registry for cross-contract validation.

[EneGab]

Hi maintainer, I've read the doc and can implement what meeds to be done
please assign me

[EmmanuelAdah]

I'd be glad to take up this issue. Leveraging my backend engineering background and experience building secure Rust smart contracts, I can effectively patch this fee diversion vulnerability. I will add an is_registered_referrer(address) view function to the referral registry to serve as a cross-contract validation check. Next, I will update place_bet in prediction_market/src/lib.rs to invoke this validation before crediting any referral fees; if the provided address is unregistered, the logic will safely default to treating the bet as referrer-less and route the 50 bps fee directly to AccumulatedFees. Finally, I will implement unit tests to verify both the correct payout for valid referrers and the strict fallback behavior that prevents Sybil amplification.

[grantfox-oss]

🦊 GrantFox — @EneGab has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #176)
2. Your PR will be reviewed by the SPulse-Org maintainers

Good luck! Track your progress on GrantFox.