Beedle - Oracle free perpetual lending

Summary

Follow the Checks-Effects-Interactions pattern in your code. This pattern suggests that you should make any state changes in your contract before calling external contracts.

Vulnerability Details

In staking.sol =>
step 1 -> // update state variables before external call
step 2 -> // interact with external contract
function claim() external {
uint256 amount = claimable[msg.sender];
require(amount > 0, "No funds to claim");

claimable[msg.sender] = 0;
updateFor(msg.sender);
balance = WETH.balanceOf(address(this));

WETH.transfer(msg.sender, amount);

}

Impact

claimable[msg.sender] is set to zero before the external call to WETH.transfer(), which minimizes the risk of a re-entrancy attack. The amount variable is used to store the claimable amount, ensuring that the correct amount of Ether is transferred

Tools Used

Olympix

Recommendations