Re-entrancy guard is missing in many functions in `Lender.sol` contract
Summary
It is well known that some ERC20 tokens like ERC777 tokens have callbacks (or hooks) like beforeTokenTransfer.
For the credit contracts that support this kind of token, an attacker can steal other lender's tokens through reentrancy exploit for close function.
Vulnerability Details
Such tokens are based on ERC20 such as ERC777, ERC223 or other customized ERC20 tokens that alert the receiver of transactions.
Example of a real-world popular token that can change control flow is PNT (pNetwork).
Impact
https://quantstamp.com/blog/how-the-dforce-hacker-used-reentrancy-to-steal-25-million
Tools Used
Code review
Recommendations
add nonReentrant guard
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.