Summary

Vulnerability Details

The burnFrom function is an external call that's made before the state updates (like updating the liquidator's collateral and the remaining liquidation amount).

Impact

Reentrancy

Tools Used

Manual

Recommendations

It's generally recommended to perform all external calls at the end of the function, after all state updates.Check Effect Interactions

Here's a sample modification for your code:

// Store necessary parameters for external call
address burnFromAddress = msg.sender;
uint88 burnAmount = m.short.ercDebt;

// Perform state changes
if (partialTappLiquidation) {
_secondaryLiquidationHelperPartialTapp(m);
} else {
_secondaryLiquidationHelper(m);
}

// Update in memory for final state change after loops
liquidatorCollateral += m.liquidatorCollateral;
liquidateAmountLeft -= m.short.ercDebt;
if (liquidateAmountLeft == 0) break;

// Make external call at the end
IAsset tokenContract = IAsset(asset);
tokenContract.burnFrom(burnFromAddress, burnAmount);