Sparkn

Summary

Possible reentrancy with callback on transfer tokens

Vulnerability Details

In Distributor.sol, the safeTransfer () function has callback to the "to" address argument.
The following functions don't apply the CEI pattern. It's possible to reenter after the transfer if the token has some kind of callback functionality (e.g. ERC777/ERC1155).

Impact

Functions with callbacks should have reentrancy guards in place for protection against possible malicious actors both from inside and outside the protocol.

Tools Used

Manual code Review

Recommendations

Add a reentrancy guard modifier on the safeTransfer() function in Distributor.sol