Summary

confirmReceipt doesn't implement the nonReentrant modifier.

Vulnerability Details

The contract inherits from ReentrancyGuard, but doesn't apply the nonReentrant to confirmReceipt.

Impact

There is a possibility that a reentrancy can happen, though the chances are very slim since the token addresses will be vetted.

Tools Used

Manual review

Recommendations

The chances of something bad happening are very unlikely, but it's still a good idea to implement the nonReentrant modifier to all functions that have an external call in them.