Sparkn

Summary

_commissionTransfer() is vulnerable to reentrancy attacks.

Vulnerability

_commissionTransfer() calls an external token contract. If the token is malicious, it could call back into _commissionTransfer() and withdraw the commission again before the state is updated.

This could allow the token.safeTransfer(STADIUM_ADDRESS, token.balanceOf(address(this))); line to be executed multiple times.

Impact

Tools Used

Manual

An attacker could drain the contract balance by recursively calling _commissionTransfer.

Recommendations

Use the checks-effects-interactions pattern: