Urgent.News

What's breaking now, across thousands of outlets.

Tech

Why Referral Attribution Fails Silently: A Lesson in Write-Once Design

Every referral system I have audited has the same shape: one write, at account creation, and no way to correct it afterwards. That shape is not an accident. It is what you get when you design for fraud resistance first and user experience second, and it produces a failure mode that engineers rarely think about, because it never throws an exception. The write When a new account is created, the…

Referral systems typically store a single write during account creation, with no method to modify it later. This design choice stems from prioritizing fraud resistance over user experience, but it creates an overlooked failure mode that engineers often neglect, as it never triggers an error. After account creation, all subsequent operations - like fee discounts, commission calculations, and reporting - rely on the referral field stored during signup.

This single write takes place within the signup transaction, competing with email verification, KYC status, initial balance, session state, and frontend modifications. Any disruption to the referral code during this process can go unnoticed, as there are no error alerts or retries. The system's design makes it impossible to differentiate between a user declining the discount or an internal failure dropping the referral information.

Furthermore, the user interface often highlights the outbound referral code prominently while quietly recording the referrer, leading users to believe their relationship is active when it may not be. To rectify this issue, three key modifications are suggested: first, echoing the referral value back to the user immediately after signup to verify the referral status; second, displaying a warning if no referral value is present and the user came from a referral link; and third, preserving the original signup request data to allow support to handle rebind requests weeks later.

While the fraud concern primarily revolves around self-referrals, making the referral field read-only does not solve the problem; instead, it shifts the issue to honest users. The economics of silent failures are compelling: referral codes on platforms like Binance offer a 20% discount on spot trading fees, funded by customer acquisition budgets.

Therefore, a silent failure incurs no cost to the platform but permanently and invisibly costs users a few percent. This discrepancy explains why such failures persist for years. A practical code to try is BBBKK, though the author emphasizes that the crucial step is the verification process, not the code itself. Note: The author receives a commission if users sign up through the provided link, which should not be considered financial advice.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

My family tree became a 404, so I built one that lives on my computer

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine What I Built I used to keep my family tree on a genealogy website: names, dates, photos.

  • Carla created open-source project Tell the Tree to build family trees locally
  • Uses Gemma 4 E2B language model on user's computer via Ollama tool
  • Allows editing, adding photos, searching, and exporting in GEDCOM format

From STL to an editable FreeCAD macro: change one number, run it again

mesh2cad turns an STL into CAD. Every part gets a STEP file with real planes, cylinders and cones. When the part is simple enough it also gets a script with named parameters, so "make the hole 2 mm…

  • Mesh2cad adds FreeCAD macro output format
  • Users edit one number to modify parts
  • Macros validated against original STL

The Room That Forgot You: A Museum Mystery with an Archivist That Runs in Your Browser

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine . What I Built The museum knows every donor's name. It cannot tell you who washed the cups.

  • Players explore a railway museum at night in a first-person browser game
  • Archivist remembers key visitors and events while details are left in the margins
  • Game uses React 19, React Three Fiber, Three.js, TypeScript, Vite, and two open-weight models

TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

  • Critical use-after-free vulnerability in IPv4 TCP handshake patched Oct 11-15, 2026
  • Remote, unauthenticated peer can exploit to leak kernel memory or crash system
  • Ubuntu and Red Hat still mark kernels vulnerable as of Oct 29 despite upstream fix

# Your SaaS Is Live. Can Anyone Tell Who It's For?

Building a working product is one challenge. Making it discoverable by people who need it is another. A developer can spend months building a SaaS product, fixing bugs, improving the interface…

  • SaaS product needs discoverability beyond technical features
  • Concrete product descriptions help users find relevant solutions
  • Structured product description aids in matching user problems

More from Saturday 31 October →