Submission Details
Severity:
Functions calling contracts/addresses with transfer hooks are missing reentrancy guards
Summary
Functions calling contracts/addresses with transfer hooks are missing reentrancy guards
Vulnerability Details
Even if the function follows the best practice of check-effects-interaction, not using a reentrancy guard when there may be transfer hooks will open the users of this protocol up to read-only reentrancies with no way to protect against it, except by block-listing the whole protocol.
File: /src/Escrow.sol
//@audit function `confirmReceipt()` is not protected against reentrancy
98: i_tokenContract.safeTransfer(i_seller, i_tokenContract.balanceOf(address(this)));
File: /src/EscrowFactory.sol
//@audit function `newEscrow()` is not protected against reentrancy
39: tokenContract.safeTransferFrom(msg.sender, computedAddress, price);
Impact
Informational
Tools Used
Manual
Recommendations
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.