DittoETH

Summary

Wrong implementation of nonReentrantView modifier does not prevent the read-only reentrancy.

Vulnerability Details

As implemented, the nonReentrantView modifier does not actually prevent read-only reentrancy, it just checks if (s.reentrantStatus == Constants.ENTERED) and nothing happens after this check, all the functions using the modifier are just being executed as if there is no modifier.

Impact

Makes read-only reentrancy possible.

Tools Used

Manual review

Recommendations

Implement the nonReentrantView modifier the proper way, as in nonReentrant modifier:

modifier nonReentrant() {
if (s.reentrantStatus == Constants.ENTERED) revert Errors.ReentrantCall();
s.reentrantStatus = Constants.ENTERED;
_;
s.reentrantStatus = Constants.NOT_ENTERED;
}