# Referrer discount token amount can be manipulated

Unlock mints referrer UDT rewards based on caller-controlled tx.gasprice, letting purchasers self-refer at inflated gas price to farm discounted UDT.

- Payout: Audit contest
- Severity: medium
- Program: Unlock Protocol
- Found by: cmichel
- Disclosed: 2022-04-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-unlock-findings/issues/155
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-unlock%3AM-09
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Unlock.recordKeyPurchase / MixinPurchase.purchase reward minting
**Root cause:** UDT reward amount is computed from tx.gasprice, which the purchaser fully controls, rather than a trusted average gas price.
**Steps:**
1. Call `MixinPurchase.purchase` with `referrer = self`
2. Set an artificially high `tx.gasprice` in the transaction
3. `Unlock.recordKeyPurchase` mints `(estimatedGasForPurchase * tx.gasprice) * 125e18 / 100 / udtPrice` UDT to the referrer
4. Sell minted UDT on external market when spot price exceeds cost
**How found:** Code reading of recordKeyPurchase reward formula noticing tx.gasprice is caller-controlled input feeding token mint amount.
**Exploitation:** Attacker buys a key with themselves as referrer at inflated gas price, receiving excess UDT, then sells UDT on market for profit; profitability depends on UDT spot vs TWAP oracle discrepancy.
**Insight:** Any reward formula that reads tx.gasprice (or other caller-set tx fields) as an input is manipulable; check oracle TWAP vs spot divergence to see if the minted amount exceeds real acquisition cost.