Function is vulnerable to reentrancy attack
Summary
The deposit function can be re-entered.
Vulnerability Details
The deposit function makes an external call to an ERC20 token. It is possible for this token to be an ERC777 (which is an ERC20 extension) that has a callback function. In that case, this function is vulnerable to reentrancy because it missing a nonReentrant modifier.
Impact
Because this is a deposit function that transfers tokens from the user to the protocol, it is not possible for the user to steal tokens. Additionally, the state is updated after the external call, so if the user reenters the function, they can only harm themselves.
Tools Used
Manual review
Recommendations
Consider using OpenZeppelin's ReentrancyGuard and add the nonReentrant modifier to the function.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.