# Any user may enforce the referral code of other new users Low/Info · Three Sigma · Hybrid orderbook DEX · 3rd April 2024 Finding 3S-Vertex-L09 of the Vertex security review. - Report: /reports/vertex - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-04-03-vertex.pdf --- ### Description In Endpoint::depositCollateralWithReferral(), the referral is set to ```solidity DEFAULT_REFERRAL_CODE if it is a remote deposit (sender != address(bytes20(subaccount)). Thus, any user may maliciously set other subaccount ``` referral code to default. It's also possible to do this by submitting a slow mode transaction of type BurnLpAndTransfer. ### Recommendation The specific fix depends on how the referral code is supposed to be handled. ### Status Addressed in [#38bbe76](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/commit/38bbe768d64139b9de91a065f4bdd1cb1e212198). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Admin new issuance or user calling `Vault::redeemExpiredLv()` after `Psm::redeemWithCt()` will lead to stuck funds when trying to withdraw](https://0xsimao.com/findings/cork-protocol-issuance-redeem-stuck-withdraw): Cork Protocol - [Anyone will DoS setting a new rewards duration which harms the protocol/users as they will receive too much or too little rewards](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-rewards-duration-harms-little): Exactly Protocol Update - Staking Contract