Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high

Possible reentrancy and fund theft in claim() function of Staking.sol

pratred

Summary

There is a possiblity of a reentrancy attack in the claim functions of the Staking.sol contract.

Vulnerability Details

Here,in the claim function of the Staking.sol contract tokens are transfered before updating the state of the claimable[msg.sender] to 0 which can cause a reentrancy attack to happen.

https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Staking.sol#L53C3-L59C5

function claim() external {
updateFor(msg.sender);
WETH.transfer(msg.sender, claimable[msg.sender]);
claimable[msg.sender] = 0;
balance = WETH.balanceOf(address(this));
}
​

Impact

This loophole could allow a attacker to execute the claim function multiple times before the previous call completes. This can lead to unexpected and harmful behavior, such as the theft of funds or unauthorized access to data.

Tools Used

Manual Review

Recommendations

Use a reentrancyGuard or update the state before transfering tokens.

function claim() external {
updateFor(msg.sender);
claimable[msg.sender] = 0;
balance = WETH.balanceOf(address(this));
WETH.transfer(msg.sender, claimable[msg.sender]);
​
}
​

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!