Sparkn

Summary

A re-entrancy attack occurs when contract calls back into the vulnerable contract's function before the original function completes. This can happen if the vulnerable contract makes external calls before completing its own state changes, allowing attacker to steal funds from the contract. We should check that balance is greater than zero, before transferring the funds.

Vulnerability Details

Modify the _commissionTransfer function =>
function _commissionTransfer(IERC20 token) internal {
uint256 balance = token.balanceOf(address(this));
if (balance > 0) {
token.safeTransfer(STADIUM_ADDRESS, balance);
}
}

Impact

In this contract, if the _commissionTransfer function is exploited for reentrancy, the attacker will repeatedly call back into the function before the transfer completes, it will lead to multiple transfers of funds to the attacker contract. This will cause loss of tokens.

Tools Used

Manual review, vs code

Recommendations