# One can become referral of hash 0x0 and because all users default referral hash is 0x0 so he would become all users referral by default and earn a lot of fees while users didn't approve it

First caller to createReferralCode(0x0) becomes default referral for all users who never set one, siphoning their trading fees.

- Payout: Contest reward
- Severity: medium
- Program: Tigris Trade
- Credited: unforgiven
- Disclosed: 2023-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/379
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Referrals.sol / TradingExtension.sol referral resolution
**Root cause:** createReferralCode lacks a zero-hash guard, and getReferred returns 0x0 for unset users, which getReferral maps to the attacker's address.
**Steps:**
1. Call `createReferralCode(0x0)` first; sets `_referral[0x0] = attacker`.
2. Any user who never set a referral has `getReferred(user) == 0x0`.
3. `getRef(user)` returns `getReferral(0x0)` = attacker.
4. `_handleOpenFees`/`_handleCloseFees` pay referral fee to attacker on every such trade.
**How found:** Code reading: noticed default `_referred[user]` is 0x0 and createReferralCode only checks `_referral[_hash] == address(0)`, so 0x0 is claimable.
**Exploitation:** Attacker front-runs by registering the zero hash; thereafter all non-referred users' open/close fees route to attacker passively.
**Insight:** In referral/affiliate systems, check whether the sentinel 'unset' value (0x0, empty string, 0) can itself be registered as a valid key — the null value often maps to real payouts.