Problem
register_code only prevents duplicate registration by checking whether the CodeOwner persistent entry currently exists. That check is only meaningful while the entry is alive — its TTL is only bumped as a side effect of a trader interacting with that code, and register_code itself sets only an initial TTL with no self-service renewal function. A code that's registered but never picked up by any trader (or whose last trader interaction is old enough) will have its CodeOwner entry's TTL run out; once expired/archived, a completely different, unrelated address can register that exact same code string and become its new owner.
If a trader's own TraderCode link (bumped independently, potentially still alive) still points at that code string, subsequent lookups will resolve to the new owner — silently reassigning that trader's referral relationship and associated rebate flows to a different, possibly malicious address, with no action or consent from the original owner or the trader.
Why it matters
This is a code-squatting/hijack vector distinct from the already-filed self-referral gap: it lets an attacker take over dormant referral codes and inherit any traders still linked to them, redirecting rebate economics without any authorized transfer ever occurring.
Suggested fix
Either give CodeOwner entries a much longer TTL (or never let them expire while any TraderCode still references them), provide a self-service renew/keep-alive function, or explicitly distinguish "never registered" from "expired" so a prior owner's claim isn't silently forfeited to squatting.
Problem
register_code only prevents duplicate registration by checking whether the CodeOwner persistent entry currently exists. That check is only meaningful while the entry is alive — its TTL is only bumped as a side effect of a trader interacting with that code, and register_code itself sets only an initial TTL with no self-service renewal function. A code that's registered but never picked up by any trader (or whose last trader interaction is old enough) will have its CodeOwner entry's TTL run out; once expired/archived, a completely different, unrelated address can register that exact same code string and become its new owner.
If a trader's own TraderCode link (bumped independently, potentially still alive) still points at that code string, subsequent lookups will resolve to the new owner — silently reassigning that trader's referral relationship and associated rebate flows to a different, possibly malicious address, with no action or consent from the original owner or the trader.
Why it matters
This is a code-squatting/hijack vector distinct from the already-filed self-referral gap: it lets an attacker take over dormant referral codes and inherit any traders still linked to them, redirecting rebate economics without any authorized transfer ever occurring.
Suggested fix
Either give CodeOwner entries a much longer TTL (or never let them expire while any TraderCode still references them), provide a self-service renew/keep-alive function, or explicitly distinguish "never registered" from "expired" so a prior owner's claim isn't silently forfeited to squatting.