This boils down to an interpretation of GDPR Article 6- Section (1) lists all 6 legal grounds for lawfulness of processing in subparagraphs a-f.
In your case, you cannot use use subparagraph a (consent). Subparagraphs c-e is also obviously out of scope, leaving subparagraph b and f.
Subparagraph b says:
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
Joining your app is "performance of a contract" and you do this "prior to entering into a contract". However, the processing is not done "at the request of the data subject". The request comes from a friend of the data subject – so: No – subparagraph b does not provide legal grounds for processing.
Subpragraph f says:
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Marketing is recognised as a legitimate interest by the EU, but having one's names publicly displayed to existing users on a website may not be in the legitimate interest of the data-subject.
To some extent I guess it depends on the website. If is a site dedicated to the appreciation of some sexual fetish, displaying names of invitees would clearly not be in the interest of the data-subject. If the site was the local chapter of the high-IQ club "Mensa", the potential harm to the legitimate interests of the data subject is much lower (I think – but it may be that somebody thinks that being associated with such a snotty bunch as "Mensa" harms their reputation, and takes you to court if you do this).
As always. Providing specific advice is not possible. If you need to know whether this marketing strategy is legal under the GDPR, get specific legal advice from a lawyer.