MEDIUM severity: The `ReferralFeeReceiver` contract is vulnerable to a malicious attack, allowing an attacker to drai. The `ReferralFeeReceiver` contract is vulnerable to a malicious attack, allowing an attacker to drain the contract's funds by manipulating the `mooniswap` pool address. The contract does not verify the authenticity of the `mooniswap` pool address, which is provided by the user, and does not check if...

Vulnerable code:
```\nif (path[0].isETH()) {\n    tx.origin.transfer(availableBalance);\n} else {\n    path[0].safeTransfer(address(mooniswap), availableBalance);\n}\n```\n```\nIERC20[] memory tokens = mooniswap.getTokens();\nuint256 token0Balance = tokens[0].balanceOf(address(this));\nuint256 token1Balance = tokens[1].balanceOf(address(this));\n```\n```\nfunction unwrapLPTokens(Mooniswap mooniswap) external validSpread(mooniswap) {\n    mooniswap.withdraw(mooniswap.balanceOf(address(this)), new uint256[](0));\n}\n\nfunction swap(IERC20[] memory path) external validPath(path) {\n    (uint256 amount, ) = _maxAmountForSwap(path, path[0].uniBalanceOf(address(this)));\n    uint256 result = _swap(path, amount, payable(address(rewards)));\n    rewards.notifyRewardAmount(result);\n}\n```\n```\nfunction updateReward(address referral, uint256 amount) external override {\n    Mooniswap mooniswap = Mooniswap(msg.sender);\n    TokenInfo storage token = tokenInfo[mooniswap];\n    UserInfo storage user = userInfo[referral];\n    uint256 currentEpoch = token.currentEpoch;\n\n    // Add new reward to current epoch\n    user.share[mooniswap][currentEpoch] = user.share[mooniswap][currentEpoch].add(amount);\n    token.epochBalance[currentEpoch].totalSupply = token.epochBalance[currentEpoch].totalSupply.add(amount);\n\n    _collectProcessedEpochs(user, token, mooniswap, currentEpoch);\n}\n```\n```\nfunction freezeEpoch(Mooniswap mooniswap) external validSpread(mooniswap) {\n    TokenInfo storage token = tokenInfo[mooniswap];\n\n    uint256 currentEpoch = token.currentEpoch;\n    require(token.firstUnprocessedEpoch == currentEpoch, "Previous epoch is not finalized");\n\n    IERC20[] memory tokens = mooniswap.getTokens();\n\n    uint256 token0Balance = tokens[0].balanceOf(address(this));\n    uint256 token1Balance = tokens[1].balanceOf(address(this));\n\n    mooniswap.withdraw(mooniswap.balanceOf(address(this)), new uint256[](0));\n\n    token.epochBalance[currentEpoch].token0Balance = tokens[0].balanceOf(address(this)).sub(token0Balance);\n    token.epochBalance[currentEpoch].token1Balance = tokens[1].balanceOf(address(this)).sub(token1Balance);\n\n    token.currentEpoch = currentEpoch.add(1);\n}\n```\n```\nif (share > 0) {\n    EpochBalance storage epochBalance = token.epochBalance[firstUnprocessedEpoch];\n    uint256 totalSupply = epochBalance.totalSupply;\n\n    user.share[mooniswap][firstUnprocessedEpoch] = 0;\n    epochBalance.totalSupply = totalSupply.sub(share);\n\n    IERC20[] memory tokens = mooniswap.getTokens();\n\n    epochBalance.token0Balance = _transferTokenShare(tokens[0], epochBalance.token0Balance, share, totalSupply);\n    epochBalance.token1Balance = _transferTokenShare(tokens[1], epochBalance.token1Balance, share, totalSupply);\n    epochBalance.inchBalance = _transferTokenShare(inchToken, epochBalance.inchBalance, share, totalSupply);\n}\n```