Beedle - Oracle free perpetual lending

Summary

The vulnerability arises due to the claim function in the Staking.sol contract, where the WETH token is transfered before updating the balance.

Vulnerability Details

The re-entrancy vulnerability occurs when a contract calls an external contract, the WETH contract, before it has resolved
its internal state, resetting the claimable[msg.sender] to 0.

Impact

The function WETH.transfer(msg.sender, claimable[msg.sender]); could potentially be a call to a malicious contract
that could re-enter the claim() function. Since the claimable[msg.sender] balance is not set to 0 until after the WETH.transfer() call, the malicious contract could drain the WETH balance of the contract.

Tools Used

Manual review

Recommendations

It is recommended to adopt the Checks-Effects-Interactions pattern, this means to make any state changes before calling external contracts and use OpenZeppelin Reentrancy Guard:

function claim() external {
    uint256 amount = claimable[msg.sender];
    require(amount > 0, "Nothing to claim");
    claimable[msg.sender] = 0;
    balance = WETH.balanceOf(address(this));
    WETH.transfer(msg.sender, amount);
}