Submission Details
Severity:
Pools are vulnerable to re-entrancy with ERC-777 tokens
Vulnerability Details
There are no re-entrancy guards on any of the functions, and the functions do not follow the checks-effects-interactions pattern. ERC777 are a subset of ERC20 and the protocol is meant to work with all ERC20 tokens. These re-entrancies can occur both in the transfer() and transferFrom functions.
Impact
Pools with ERC777 tokens are vulnerable to being drained via re-entrancy
Tools Used
Manual Review
Recommendations
ERC777 tokens should not be used in pools
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.