MixinPurchase#purchase() Consider checking if _referrer equals _recipient

[code423n4]

Handle

WatchPug

Vulnerability details

Based on the context, it might be needed to check if _referrer equals _recipient and only pay UDT grants when _referrer != _recipient.

https://github.com/code-423n4/2021-11-unlock/blob/ec41eada1dd116bcccc5603ce342257584bec783/smart-contracts/contracts/mixins/MixinPurchase.sol#L35-L43

  function purchase(
    uint256 _value,
    address _recipient,
    address _referrer,
    bytes calldata _data
  ) external payable
    onlyIfAlive
    notSoldOut
  {

[julien51]

Why? We actually explicitly want to allow the recipient to receive the UDT.
In any case, this is limited to gas spent, so the recipient will on only at best get the UDT that they could have purchased on some exchange for the amount of gas they spent.