Beedle - Oracle free perpetual lending

Summary

The function claim makes an external call and lacks the nonReentrant modifier and does not follow the CEI pattern.

Vulnerability Details

The function is designed to use with WETH, which does not have a callback function and therefore cannot be reentered. However, if the WETH storage variable is set to another token with a callback, there exists a possibility for the function to be reentered and funds to be drained.

It is recommended to follow the CEI pattern or add a nonReentrant modifier, even when using a known token like WETH, which doesn't have a callback function that could transfer the execution flow to the caller.

Impact

If WETH storage variable is set to another token that has a callback, it becomes feasible for the function to be reentered and funds to be drained.

Tools Used

Manual review

Recommendations

Consider using OpenZeppelin's ReentrancyGuard and add the nonReentrant modifier to the function.