Since we are getting pilloried over things that are not our fault, I'd like to clarify what's going on with the 'Avalytics Referrals'.
Let me clarify how referrals work; when you send a TX from Arena with a referral set for the first time, it gets indelibly written into the blockchain and cannot be (normally) overwritten. The one exception is when the 'migrations' happen, if they don't also migrate referrals.
Two and a half weeks ago, we (apparently) started getting referral fees for the Avalytics account. This corresponds to a migration that Arena did, where they did not migrate referrals.
It seems like there's some backend system which tracks the 'latest' referral for a user and sends it whenever a trade is made. If you click on a referral link, it updates that value in the database. Then when you send a TX, it includes that referral. If you've ever had a referral set, obviously this does nothing and your original referrer gets the fee.
A previous incarnation of ArenaBook, in an attempt to fund itself, had avalytics as the referrer on outgoing links. For the vast majority of users this did nothing because they already had their referrer set by an actual person, or overridden by Hannes to one of his sock puppets.
But it seems like that value got stored in the DB for everyone who used ArenaBook. And when they neglected to write referrers onto the blockchain, suddenly that value started getting set. We noticed yesterday that we had started getting money (wooo) about two weeks ago, which corresponds to the previous migration.
If you look in ArenaBook, you'll see the accurate number of referrals you have ACCORDING TO THE BLOCKCHAIN. You will notice a difference between that number, and the number reported by Arena. This is because those referrers aren't set yet into the blockchain; theoretically if those users send a TX to buy or sell a ticket, the number in ArenaBook will go up, the number in Arena will stay the same.
So no, there's no secret conspiracy to steal your referrals. This isn't anything that we (VQ and I) did. It's just the unexpected emergent behavior of a complicated set of circumstances.
As for the fix, it's probably to wipe out Avalytics from every user in the database, and then use the admin tools in the contract to bulk-overwrite the values on the blockchain. This isn't that complicated but will probably need some planning and execution, I assume it will take a day or two on their side (again, there's nothing I can do about this).