[CRITICAL] `credit` transfers XLM to an arbitrary referrer address — reentrancy and fund-drain vector

[grantfox-oss]

Summary

referral_registry credit transfers XLM to an arbitrary referrer address provided by the caller. Since the referrer address is user-controlled (set in register_referral), a user can set their referrer to a malicious contract that reenters place_bet, claim, or cancel_refund on the prediction market.

Impact

• Reentrancy: a malicious referrer contract's fallback can reenter the prediction market before BetEntry is written, observing stale state.
• Fund drain: the contract sends XLM to an address the caller controls — an attacker can set the referrer to their own contract and siphon fees.
• Unauthenticated external call: the XLM transfer is to a raw address with no validation that the referrer is a legitimate registered referrer.

Fix

• Validate that the referrer address is a registered referrer before paying.
• Use a reentrancy guard on credit (and on any entry point that receives XLM from bets).
• Consider paying fees via a pull-based mechanism (accrue claims, let referrer withdraw) rather than push.

[Emelie-Dev]

Hi, I would love to work on this issue.

[Benalex8797]

hi maintainer i will love to resolve this issue please assign

[grantfox-oss]

🦊 GrantFox — @Benalex8797 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #165)
2. Your PR will be reviewed by the SPulse-Org maintainers

Good luck! Track your progress on GrantFox.