Missing checks on the `referral_cut` value could enable creating unlimited membership accounts for free

Summary

In the membership pallet, a referral_cut value can be configured that determines a referral bonus to incentivize inviting new members for existing members. The special case when the referral_cut == membership_fee enables any user to create unlimited new membership accounts for free. Since both the referral_cut and membership_fee values can be configured via root calls/proposals, we consider this as an information-level issue. As a defensive programming practice, we recommend to ensure that the referral cut is aways less than the membership fee.

Issue details

In the membership pallet, a referral_cut value can be configured that determines a referral bonus to incentivize inviting new members for existing members. The referral bonus is calculated in the following way:

    // Calculate current referral bonus. It minimum between membership fee and referral cut.
    pub(crate) fn get_referral_bonus() -> BalanceOf<T> {
        let membership_fee = Self::membership_price();
        let referral_cut = Self::referral_cut();

        membership_fee.min(referral_cut)
    }

The referral bonus is the minimum of membership_fee and referral_cut. If these two values are equal, one could create infinite new accounts for free (create account a, create account b, refer account a -> a's registration was waived, etc).

Risk

If referral_cut == membership_fee, it enables any user to create unlimited new membership accounts for free. Since both of these values can be configured via root calls (set_referral_cut and here set_membership_price), we consider the risk of this very low.

Mitigation

We recommend to enforce that referral_cut < membership_fee always holds, either by providing guidelines for setting these values in a sensible way, or ensuring this relation programmatically.

Start by locating the membership pallet and its set_referral_cut and set_membership_price entry points, then trace get_referral_bonus to understand how configuration values affect account creation. Done means the referral cut is prevented from equaling or exceeding the membership fee, either through programmatic enforcement or clearly documented configuration guidance.